{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.redhat.com/nudged-components": "fj-multi-component-child-wuls", "build.appstudio.redhat.com/nudging-commit": "5d20ea5566c9ac535b6696fd9431ead9f68f8c38", "build.appstudio.redhat.com/nudging-component": "fj-multi-component-parent-wuls", "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-ajhu/fj-multi-component-parent-wuls:5d20ea5566c9ac535b6696fd9431ead9f68f8c38", "build.appstudio.redhat.com/nudging-pipeline": "fj-multi-component-parent-wuls-on-push-lj4t9", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-ajhu/results/584fb94b-1478-48b3-bac7-c62dd1a94070/records/80734970-0f3d-49f5-bec9-a59256a36ab7", "results.tekton.dev/result": "build-e2e-ajhu/results/584fb94b-1478-48b3-bac7-c62dd1a94070", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a627336dac44ad0117497a0964fb785a-8cb5e567ed822cda-01\"}" }, "creationTimestamp": "2026-05-19T12:10:55Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "build.appstudio.redhat.com/type": "nudge", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-pipeline-1779192655-60ffa", "tekton.dev/pipelineRun": "renovate-pipeline-1779192655-60ffa", "tekton.dev/pipelineRunUID": "584fb94b-1478-48b3-bac7-c62dd1a94070", "tekton.dev/pipelineTask": "renovate" }, "name": "renovate-pipeline-1779192655-60ffa-renovate", "namespace": "build-e2e-ajhu", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-pipeline-1779192655-60ffa", "uid": "584fb94b-1478-48b3-bac7-c62dd1a94070" } ], "resourceVersion": "125834", "uid": "80734970-0f3d-49f5-bec9-a59256a36ab7" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-fj-multi-component-parent-wuls", "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_5caac62b05 RENOVATE_CONFIG_FILE=/configs/fj-multi-component-child-wuls-b32e1.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_ajhu_fj_multi_component_parent_wuls_6d68663538','password':'${TOKEN_9a71aec7d7}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1779192655-60ffa" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1779192655-60ffa" }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "trusted-ca", "readOnly": true } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1779192655-60ffa" }, "name": "renovate-pipeline-1779192655-60ffa" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "renovate-ca-1779192655-60ffa" }, "name": "trusted-ca" } ] }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T12:11:10Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:11:10Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "renovate-pipeline-1779192655-60ffa-renovate-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-a627336dac44ad0117497a0964fb785a-8cb5e567ed822cda-01" }, "startTime": "2026-05-19T12:10:55Z", "steps": [ { "container": "step-renovate", "imageID": "quay.io/konflux-ci/mintmaker-renovate-image@sha256:67d26b20533790565a2949a3f732d595dda9378fea506f1cba88ca17cef13873", "name": "renovate", "provenance": {}, "terminated": { "containerID": "cri-o://abbc20e73c6891986764ebed94423951cc766d91f4ba1c2ce7e371c62556f3fc", "exitCode": 0, "finishedAt": "2026-05-19T12:11:09Z", "reason": "Completed", "startedAt": "2026-05-19T12:11:00Z" }, "terminationReason": "Completed" } ], "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_5caac62b05 RENOVATE_CONFIG_FILE=/configs/fj-multi-component-child-wuls-b32e1.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_ajhu_fj_multi_component_parent_wuls_6d68663538','password':'${TOKEN_9a71aec7d7}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1779192655-60ffa" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1779192655-60ffa" }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "trusted-ca", "readOnly": true } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1779192655-60ffa" }, "name": "renovate-pipeline-1779192655-60ffa" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "renovate-ca-1779192655-60ffa" }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/commit_sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cxdclc", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-qrc8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f/records/638d88e7-53fc-470b-9a97-731a71d2af87", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-076616e8b3b0f008d35512fa77714c3d-73630b8f2dcb64e9-01\"}" }, "creationTimestamp": "2026-05-19T11:44:03Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRunUID": "176335ee-12e6-4daf-a026-88b9e32b3b8f", "tekton.dev/pipelineTask": "deprecated-base-image-check", "tekton.dev/task": "deprecated-image-check" }, "name": "gl-111590fe58cfbb8d8348a16e3bc742ff-deprecated-base-image-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-qrc8h", "uid": "176335ee-12e6-4daf-a026-88b9e32b3b8f" } ], "resourceVersion": "93872", "uid": "638d88e7-53fc-470b-9a97-731a71d2af87" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "IMAGE_DIGEST", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:14Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:14Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-111590fe58cfbb8d8348a16ecb8f5219ac089d042769337b6e8f5829-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, "entryPoint": "deprecated-image-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\", \"digests\": [\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-19T11:44:13+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n" } ], "spanContext": { "traceparent": "00-076616e8b3b0f008d35512fa77714c3d-73630b8f2dcb64e9-01" }, "startTime": "2026-05-19T11:44:03Z", "steps": [ { "container": "step-check-images", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "provenance": {}, "terminated": { "containerID": "cri-o://5e72f4656d8176ab049cefd18b79116ea494495fbf43d1985f238060554a1248", "exitCode": 0, "finishedAt": "2026-05-19T11:44:13Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\\\", \\\"digests\\\": [\\\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:13+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:08Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.", "params": [ { "default": "/project/repository/", "description": "Path to directory containing Conftest policies.", "name": "POLICY_DIR", "type": "string" }, { "default": "required_checks", "description": "Namespace for Conftest policy.", "name": "POLICY_NAMESPACE", "type": "string" }, { "default": "", "description": "Digests of base build images.", "name": "BASE_IMAGES_DIGESTS", "type": "string" }, { "description": "Fully qualified image name.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "POLICY_DIR", "value": "/project/repository/" }, { "name": "POLICY_NAMESPACE", "value": "required_checks" }, { "name": "BASE_IMAGES_DIGESTS" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "IMAGE_DIGEST", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n while read -r arch arch_sha; do\n SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Get base images from SBOM\n if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n echo \"Unable to download sbom for arch $arch.\"\n continue\n fi\n\n \u003c \"${SBOM_FILE_PATH}\" jq -r '\n if .bomFormat == \"CycloneDX\" then\n .formulation[]?\n | .components[]?\n | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n | (\n .purl\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n else\n .packages[]\n | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n | (\n $purls | first\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n end\n ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"Detected base images from $arch SBOM:\"\n cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"\"\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n # Get images from the parameter\n for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n do\n echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n mkdir -p \"${IMAGE_REPO_PATH}\"\n echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n if [ \"$http_code\" == \"200\" ];\n then\n echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${failures_num}\" -gt 0 ]]; then\n echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n fi\n failure_counter=$((failure_counter+failures_num))\n\n successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${successes_num}\" -gt 0 ]]; then\n echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n fi\n success_counter=$((success_counter+successes_num))\n\n elif [ \"$http_code\" == \"404\" ];\n then\n echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n warnings_counter=$((warnings_counter+1))\n else\n echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n error_counter=$((error_counter+1))\n fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n if [[ \"${failure_counter}\" -gt 0 ]]; then\n RES=\"FAILURE\"\n elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n RES=\"WARNING\"\n elif [[ \"${success_counter}\" -eq 0 ]]; then\n # when all counters are 0, there are no base images to check\n note=\"Task deprecated-image-check success: No base images to check.\"\n RES=\"SUCCESS\"\n else\n RES=\"SUCCESS\"\n fi\n TEST_OUTPUT=$(make_result_json \\\n -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/commit_sha": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-rbxbrr", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111804", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-push-r8tjg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-ozak' into 'multi-component-parent-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f/records/62c797ec-5f23-4fb1-9ba7-c4879a32abc1", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"1635086a67b70da955b6ec55379eba702eded716\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-2478d72c89567a3a5a71a1aa38c4ecde-c0165f813cbc1f8a-01\"}" }, "creationTimestamp": "2026-05-19T11:43:58Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRunUID": "308865f3-3843-4928-bc02-8eebfe5b4c5f", "tekton.dev/pipelineTask": "deprecated-base-image-check", "tekton.dev/task": "deprecated-image-check" }, "name": "gl-34ed2d3a1eea78cc09d0cab1648bcfe8-deprecated-base-image-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-push-r8tjg", "uid": "308865f3-3843-4928-bc02-8eebfe5b4c5f" } ], "resourceVersion": "93785", "uid": "62c797ec-5f23-4fb1-9ba7-c4879a32abc1" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "IMAGE_DIGEST", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:09Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:09Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-34ed2d3a1eea78cc09d0cab149f47b892ac5e86b32484ac15cfab3c3-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, "entryPoint": "deprecated-image-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\", \"digests\": [\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:44:09+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":1,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-2478d72c89567a3a5a71a1aa38c4ecde-c0165f813cbc1f8a-01" }, "startTime": "2026-05-19T11:43:58Z", "steps": [ { "container": "step-check-images", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "provenance": {}, "terminated": { "containerID": "cri-o://2a94b80f242431e08d5da3fd755e0b72a31364ce7507a0bbe102b46f8e0259e0", "exitCode": 0, "finishedAt": "2026-05-19T11:44:09Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\\\", \\\"digests\\\": [\\\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:09+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":1,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:03Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.", "params": [ { "default": "/project/repository/", "description": "Path to directory containing Conftest policies.", "name": "POLICY_DIR", "type": "string" }, { "default": "required_checks", "description": "Namespace for Conftest policy.", "name": "POLICY_NAMESPACE", "type": "string" }, { "default": "", "description": "Digests of base build images.", "name": "BASE_IMAGES_DIGESTS", "type": "string" }, { "description": "Fully qualified image name.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "POLICY_DIR", "value": "/project/repository/" }, { "name": "POLICY_NAMESPACE", "value": "required_checks" }, { "name": "BASE_IMAGES_DIGESTS" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "IMAGE_DIGEST", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n while read -r arch arch_sha; do\n SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Get base images from SBOM\n if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n echo \"Unable to download sbom for arch $arch.\"\n continue\n fi\n\n \u003c \"${SBOM_FILE_PATH}\" jq -r '\n if .bomFormat == \"CycloneDX\" then\n .formulation[]?\n | .components[]?\n | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n | (\n .purl\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n else\n .packages[]\n | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n | (\n $purls | first\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n end\n ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"Detected base images from $arch SBOM:\"\n cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"\"\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n # Get images from the parameter\n for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n do\n echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n mkdir -p \"${IMAGE_REPO_PATH}\"\n echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n if [ \"$http_code\" == \"200\" ];\n then\n echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${failures_num}\" -gt 0 ]]; then\n echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n fi\n failure_counter=$((failure_counter+failures_num))\n\n successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${successes_num}\" -gt 0 ]]; then\n echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n fi\n success_counter=$((success_counter+successes_num))\n\n elif [ \"$http_code\" == \"404\" ];\n then\n echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n warnings_counter=$((warnings_counter+1))\n else\n echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n error_counter=$((error_counter+1))\n fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n if [[ \"${failure_counter}\" -gt 0 ]]; then\n RES=\"FAILURE\"\n elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n RES=\"WARNING\"\n elif [[ \"${success_counter}\" -eq 0 ]]; then\n # when all counters are 0, there are no base images to check\n note=\"Task deprecated-image-check success: No base images to check.\"\n RES=\"SUCCESS\"\n else\n RES=\"SUCCESS\"\n fi\n TEST_OUTPUT=$(make_result_json \\\n -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/commit_sha": "4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uilbnm", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537094607", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-s6q6q", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2/records/970c1ce9-d024-4673-8444-92ccc9a11d59", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db1dcf7d8e317492d30931804712ebee-05b7ac673ec5fb2c-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:38:54Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRunUID": "a6fd6532-085f-49d9-8167-57532fd6ecd2", "tekton.dev/pipelineTask": "deprecated-base-image-check", "tekton.dev/task": "deprecated-image-check", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-4a2a2be585514454a0d63daa59818ab1-deprecated-base-image-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "uid": "a6fd6532-085f-49d9-8167-57532fd6ecd2" } ], "resourceVersion": "85672", "uid": "970c1ce9-d024-4673-8444-92ccc9a11d59" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "IMAGE_DIGEST", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:39:06Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:39:06Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-4a2a2be585514454a0d63daa1b427032e2b6206a86859c37dffc764e-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, "entryPoint": "deprecated-image-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\", \"digests\": [\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-19T11:39:06+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n" } ], "spanContext": { "traceparent": "00-db1dcf7d8e317492d30931804712ebee-05b7ac673ec5fb2c-01" }, "startTime": "2026-05-19T11:38:54Z", "steps": [ { "container": "step-check-images", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "provenance": {}, "terminated": { "containerID": "cri-o://dd14f731265cc09ae200992ee9dc22cf6b2b8a44e6c92665aa45f57a595fd4c1", "exitCode": 0, "finishedAt": "2026-05-19T11:39:06Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\\\", \\\"digests\\\": [\\\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-19T11:39:06+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:39:00Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.", "params": [ { "default": "/project/repository/", "description": "Path to directory containing Conftest policies.", "name": "POLICY_DIR", "type": "string" }, { "default": "required_checks", "description": "Namespace for Conftest policy.", "name": "POLICY_NAMESPACE", "type": "string" }, { "default": "", "description": "Digests of base build images.", "name": "BASE_IMAGES_DIGESTS", "type": "string" }, { "description": "Fully qualified image name.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "POLICY_DIR", "value": "/project/repository/" }, { "name": "POLICY_NAMESPACE", "value": "required_checks" }, { "name": "BASE_IMAGES_DIGESTS" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "IMAGE_DIGEST", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n while read -r arch arch_sha; do\n SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Get base images from SBOM\n if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n echo \"Unable to download sbom for arch $arch.\"\n continue\n fi\n\n \u003c \"${SBOM_FILE_PATH}\" jq -r '\n if .bomFormat == \"CycloneDX\" then\n .formulation[]?\n | .components[]?\n | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n | (\n .purl\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n else\n .packages[]\n | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n | (\n $purls | first\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n end\n ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"Detected base images from $arch SBOM:\"\n cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"\"\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n # Get images from the parameter\n for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n do\n echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n mkdir -p \"${IMAGE_REPO_PATH}\"\n echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n if [ \"$http_code\" == \"200\" ];\n then\n echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${failures_num}\" -gt 0 ]]; then\n echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n fi\n failure_counter=$((failure_counter+failures_num))\n\n successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${successes_num}\" -gt 0 ]]; then\n echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n fi\n success_counter=$((success_counter+successes_num))\n\n elif [ \"$http_code\" == \"404\" ];\n then\n echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n warnings_counter=$((warnings_counter+1))\n else\n echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n error_counter=$((error_counter+1))\n fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n if [[ \"${failure_counter}\" -gt 0 ]]; then\n RES=\"FAILURE\"\n elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n RES=\"WARNING\"\n elif [[ \"${success_counter}\" -eq 0 ]]; then\n # when all counters are 0, there are no base images to check\n note=\"Task deprecated-image-check success: No base images to check.\"\n RES=\"SUCCESS\"\n else\n RES=\"SUCCESS\"\n fi\n TEST_OUTPUT=$(make_result_json \\\n -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/commit_sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gsjcir", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537109186", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-7g9x2", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee/records/707488c3-53fc-448d-abe1-d37b560731ff", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}", "results.tekton.dev/result": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8511962eff22b59cfd9661580edff4f0-827540ec55bef7b3-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:43:08Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRunUID": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "tekton.dev/pipelineTask": "deprecated-base-image-check", "tekton.dev/task": "deprecated-image-check", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-51f41fbdd6a4d2cd9bf9d1199bdc0f8c-deprecated-base-image-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "uid": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee" } ], "resourceVersion": "92219", "uid": "707488c3-53fc-448d-abe1-d37b560731ff" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "IMAGE_DIGEST", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:21Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:21Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-51f41fbdd6a4d2cd9bf9d11933e9814ce960a81ece20e5f8327efac4-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, "entryPoint": "deprecated-image-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\", \"digests\": [\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-19T11:43:20+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n" } ], "spanContext": { "traceparent": "00-8511962eff22b59cfd9661580edff4f0-827540ec55bef7b3-01" }, "startTime": "2026-05-19T11:43:08Z", "steps": [ { "container": "step-check-images", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "provenance": {}, "terminated": { "containerID": "cri-o://8a107ef7fc28a0228563f21a60df4343ea0294cb758e1244f6f8fbf891b49b42", "exitCode": 0, "finishedAt": "2026-05-19T11:43:20Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\\\", \\\"digests\\\": [\\\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:20+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:14Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.", "params": [ { "default": "/project/repository/", "description": "Path to directory containing Conftest policies.", "name": "POLICY_DIR", "type": "string" }, { "default": "required_checks", "description": "Namespace for Conftest policy.", "name": "POLICY_NAMESPACE", "type": "string" }, { "default": "", "description": "Digests of base build images.", "name": "BASE_IMAGES_DIGESTS", "type": "string" }, { "description": "Fully qualified image name.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "POLICY_DIR", "value": "/project/repository/" }, { "name": "POLICY_NAMESPACE", "value": "required_checks" }, { "name": "BASE_IMAGES_DIGESTS" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "IMAGE_DIGEST", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n while read -r arch arch_sha; do\n SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Get base images from SBOM\n if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n echo \"Unable to download sbom for arch $arch.\"\n continue\n fi\n\n \u003c \"${SBOM_FILE_PATH}\" jq -r '\n if .bomFormat == \"CycloneDX\" then\n .formulation[]?\n | .components[]?\n | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n | (\n .purl\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n else\n .packages[]\n | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n | (\n $purls | first\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n end\n ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"Detected base images from $arch SBOM:\"\n cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"\"\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n # Get images from the parameter\n for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n do\n echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n mkdir -p \"${IMAGE_REPO_PATH}\"\n echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n if [ \"$http_code\" == \"200\" ];\n then\n echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${failures_num}\" -gt 0 ]]; then\n echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n fi\n failure_counter=$((failure_counter+failures_num))\n\n successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${successes_num}\" -gt 0 ]]; then\n echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n fi\n success_counter=$((success_counter+successes_num))\n\n elif [ \"$http_code\" == \"404\" ];\n then\n echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n warnings_counter=$((warnings_counter+1))\n else\n echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n error_counter=$((error_counter+1))\n fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n if [[ \"${failure_counter}\" -gt 0 ]]; then\n RES=\"FAILURE\"\n elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n RES=\"WARNING\"\n elif [[ \"${success_counter}\" -eq 0 ]]; then\n # when all counters are 0, there are no base images to check\n note=\"Task deprecated-image-check success: No base images to check.\"\n RES=\"SUCCESS\"\n else\n RES=\"SUCCESS\"\n fi\n TEST_OUTPUT=$(make_result_json \\\n -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/commit_sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-efgczi", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537079501", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-pull-request-p8f29", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de/records/422fcf79-1a12-45d9-a73f-087735f1630a", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-660eee8a28dcd3f4219f7b9a24544a26-ed16b0b48d2a3d99-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-ozak" }, "creationTimestamp": "2026-05-19T11:34:12Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRunUID": "f15699a7-890e-44ed-894d-e491f912d6de", "tekton.dev/pipelineTask": "deprecated-base-image-check", "tekton.dev/task": "deprecated-image-check", "test.appstudio.openshift.io/pr-group-sha": "529787a3d31011e383e7ca8b1425806842b93c02ed7a11d2dfaa720615f604" }, "name": "gl-538c768f343f6ebf90f8f9860f456015-deprecated-base-image-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "uid": "f15699a7-890e-44ed-894d-e491f912d6de" } ], "resourceVersion": "79235", "uid": "422fcf79-1a12-45d9-a73f-087735f1630a" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "IMAGE_DIGEST", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:24Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:24Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-538c768f343f6ebf90f8f98606dc46ce9ae4f9cdbd4ec8c22a3456bf-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, "entryPoint": "deprecated-image-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\", \"digests\": [\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:34:24+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":1,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-660eee8a28dcd3f4219f7b9a24544a26-ed16b0b48d2a3d99-01" }, "startTime": "2026-05-19T11:34:12Z", "steps": [ { "container": "step-check-images", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "provenance": {}, "terminated": { "containerID": "cri-o://bc7b555b7a8dd91fcf74e305b2bced8b0a4b956cc9b761735e584348ab1d9591", "exitCode": 0, "finishedAt": "2026-05-19T11:34:24Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\\\", \\\"digests\\\": [\\\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:24+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":1,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:17Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.", "params": [ { "default": "/project/repository/", "description": "Path to directory containing Conftest policies.", "name": "POLICY_DIR", "type": "string" }, { "default": "required_checks", "description": "Namespace for Conftest policy.", "name": "POLICY_NAMESPACE", "type": "string" }, { "default": "", "description": "Digests of base build images.", "name": "BASE_IMAGES_DIGESTS", "type": "string" }, { "description": "Fully qualified image name.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "POLICY_DIR", "value": "/project/repository/" }, { "name": "POLICY_NAMESPACE", "value": "required_checks" }, { "name": "BASE_IMAGES_DIGESTS" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "IMAGE_DIGEST", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n while read -r arch arch_sha; do\n SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Get base images from SBOM\n if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n echo \"Unable to download sbom for arch $arch.\"\n continue\n fi\n\n \u003c \"${SBOM_FILE_PATH}\" jq -r '\n if .bomFormat == \"CycloneDX\" then\n .formulation[]?\n | .components[]?\n | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n | (\n .purl\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n else\n .packages[]\n | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n | (\n $purls | first\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n end\n ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"Detected base images from $arch SBOM:\"\n cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"\"\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n # Get images from the parameter\n for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n do\n echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n mkdir -p \"${IMAGE_REPO_PATH}\"\n echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n if [ \"$http_code\" == \"200\" ];\n then\n echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${failures_num}\" -gt 0 ]]; then\n echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n fi\n failure_counter=$((failure_counter+failures_num))\n\n successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${successes_num}\" -gt 0 ]]; then\n echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n fi\n success_counter=$((success_counter+successes_num))\n\n elif [ \"$http_code\" == \"404\" ];\n then\n echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n warnings_counter=$((warnings_counter+1))\n else\n echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n error_counter=$((error_counter+1))\n fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n if [[ \"${failure_counter}\" -gt 0 ]]; then\n RES=\"FAILURE\"\n elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n RES=\"WARNING\"\n elif [[ \"${success_counter}\" -eq 0 ]]; then\n # when all counters are 0, there are no base images to check\n note=\"Task deprecated-image-check success: No base images to check.\"\n RES=\"SUCCESS\"\n else\n RES=\"SUCCESS\"\n fi\n TEST_OUTPUT=$(make_result_json \\\n -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/commit_sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jtxnsl", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537108878", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-74rs9", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492/records/c5748a31-f923-4208-b8a8-dd803e834129", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bd24a6e803660a298babd09432c7cb55-1a0e91dd49c85fdc-01\"}" }, "creationTimestamp": "2026-05-19T11:43:00Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRunUID": "27a968ed-f718-49fc-ab32-71b6240d3492", "tekton.dev/pipelineTask": "deprecated-base-image-check", "tekton.dev/task": "deprecated-image-check" }, "name": "gl-d9eaaa4995aa12b0512a4b569ed94a3b-deprecated-base-image-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-74rs9", "uid": "27a968ed-f718-49fc-ab32-71b6240d3492" } ], "resourceVersion": "91984", "uid": "c5748a31-f923-4208-b8a8-dd803e834129" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "IMAGE_DIGEST", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:12Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:12Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-d9eaaa4995aa12b0512a4b566162644aed6044d612f7791fb28fb0c3-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, "entryPoint": "deprecated-image-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\", \"digests\": [\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-19T11:43:11+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n" } ], "spanContext": { "traceparent": "00-bd24a6e803660a298babd09432c7cb55-1a0e91dd49c85fdc-01" }, "startTime": "2026-05-19T11:43:00Z", "steps": [ { "container": "step-check-images", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "provenance": {}, "terminated": { "containerID": "cri-o://2f4c84c3b7c8504f2e570edff8cce79901f531f0e0bae0658da2cb9c03088aa8", "exitCode": 0, "finishedAt": "2026-05-19T11:43:11Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\\\", \\\"digests\\\": [\\\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:11+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:05Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.", "params": [ { "default": "/project/repository/", "description": "Path to directory containing Conftest policies.", "name": "POLICY_DIR", "type": "string" }, { "default": "required_checks", "description": "Namespace for Conftest policy.", "name": "POLICY_NAMESPACE", "type": "string" }, { "default": "", "description": "Digests of base build images.", "name": "BASE_IMAGES_DIGESTS", "type": "string" }, { "description": "Fully qualified image name.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "POLICY_DIR", "value": "/project/repository/" }, { "name": "POLICY_NAMESPACE", "value": "required_checks" }, { "name": "BASE_IMAGES_DIGESTS" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "IMAGE_DIGEST", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n while read -r arch arch_sha; do\n SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Get base images from SBOM\n if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n echo \"Unable to download sbom for arch $arch.\"\n continue\n fi\n\n \u003c \"${SBOM_FILE_PATH}\" jq -r '\n if .bomFormat == \"CycloneDX\" then\n .formulation[]?\n | .components[]?\n | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n | (\n .purl\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n else\n .packages[]\n | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n | (\n $purls | first\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n end\n ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"Detected base images from $arch SBOM:\"\n cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"\"\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n # Get images from the parameter\n for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n do\n echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n mkdir -p \"${IMAGE_REPO_PATH}\"\n echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n if [ \"$http_code\" == \"200\" ];\n then\n echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${failures_num}\" -gt 0 ]]; then\n echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n fi\n failure_counter=$((failure_counter+failures_num))\n\n successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${successes_num}\" -gt 0 ]]; then\n echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n fi\n success_counter=$((success_counter+successes_num))\n\n elif [ \"$http_code\" == \"404\" ];\n then\n echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n warnings_counter=$((warnings_counter+1))\n else\n echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n error_counter=$((error_counter+1))\n fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n if [[ \"${failure_counter}\" -gt 0 ]]; then\n RES=\"FAILURE\"\n elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n RES=\"WARNING\"\n elif [[ \"${success_counter}\" -eq 0 ]]; then\n # when all counters are 0, there are no base images to check\n note=\"Task deprecated-image-check success: No base images to check.\"\n RES=\"SUCCESS\"\n else\n RES=\"SUCCESS\"\n fi\n TEST_OUTPUT=$(make_result_json \\\n -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/commit_sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cxdclc", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-qrc8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f/records/b6ee2318-1783-4e8c-bb0d-0851fe073cef", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-076616e8b3b0f008d35512fa77714c3d-b6bfa48800c7473e-01\"}" }, "creationTimestamp": "2026-05-19T11:41:20Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRunUID": "176335ee-12e6-4daf-a026-88b9e32b3b8f", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies-oci-ta-min" }, "name": "gl-multi-111590fe58cfbb8d8348a16e3bc742ff-prefetch-dependencies", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-qrc8h", "uid": "176335ee-12e6-4daf-a026-88b9e32b3b8f" } ], "resourceVersion": "90067", "uid": "b6ee2318-1783-4e8c-bb0d-0851fe073cef" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6.prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "git-basic-auth", "secret": { "secretName": "pac-gitauth-cxdclc" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:41:59Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:41:59Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-111590fe58cfbb8d834e2a0091de6bbf2993da16721d8a6950-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, "entryPoint": "prefetch-dependencies-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min" } }, "results": [ { "name": "CACHI2_ARTIFACT", "type": "string", "value": "" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591" } ], "spanContext": { "traceparent": "00-076616e8b3b0f008d35512fa77714c3d-b6bfa48800c7473e-01" }, "startTime": "2026-05-19T11:41:21Z", "steps": [ { "container": "step-skip-ta", "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "provenance": {}, "terminated": { "containerID": "cri-o://14c91d429ef38b8e71374d9e2d24a1da154c3d0842dc5589a093067346778137", "exitCode": 0, "finishedAt": "2026-05-19T11:41:26Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:26Z" }, "terminationReason": "Completed" }, { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://9311c14ebbee80ff7041c856295e98e983d180a2ac56fe1b69d3f174be532299", "exitCode": 0, "finishedAt": "2026-05-19T11:41:26Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:26Z" }, "terminationReason": "Completed" }, { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "provenance": {}, "terminated": { "containerID": "cri-o://a1eec5c22626a5b91d05f954c881727f99932cfa72321931b4ce46ee25d5e020", "exitCode": 0, "finishedAt": "2026-05-19T11:41:58Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:26Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://e7ee8dd0b324ae4e958e510d0e73cc3a7cd4d6d8ac6134468d2c066a3ce6ad46", "exitCode": 0, "finishedAt": "2026-05-19T11:41:59Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:58Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" } ], "results": [ { "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "computeResources": {}, "env": [ { "name": "INPUT" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591" } ], "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n mkdir -p /var/workdir/source\n mkdir -p /var/workdir/cachi2\n echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n" }, { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591=/var/workdir/source" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/var/workdir/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/var/workdir/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY", "value": "/workspace/git-basic-auth" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" } ], "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6.prefetch", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source", "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "emptyDir": {}, "name": "config" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/commit_sha": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-rbxbrr", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111804", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-push-r8tjg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-ozak' into 'multi-component-parent-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f/records/bbf015dd-268d-45c1-9b2c-f1978db8e04d", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"1635086a67b70da955b6ec55379eba702eded716\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-2478d72c89567a3a5a71a1aa38c4ecde-6cf29a3258f444a5-01\"}" }, "creationTimestamp": "2026-05-19T11:41:22Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRunUID": "308865f3-3843-4928-bc02-8eebfe5b4c5f", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies-oci-ta-min" }, "name": "gl-multi-34ed2d3a1eea78cc09d0cab1648bcfe8-prefetch-dependencies", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-push-r8tjg", "uid": "308865f3-3843-4928-bc02-8eebfe5b4c5f" } ], "resourceVersion": "90103", "uid": "bbf015dd-268d-45c1-9b2c-f1978db8e04d" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716.prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "git-basic-auth", "secret": { "secretName": "pac-gitauth-rbxbrr" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:42:00Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:42:00Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-34ed2d3a1eea78cc09f3ecb91ae264710734e8773b8c4299ca-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, "entryPoint": "prefetch-dependencies-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min" } }, "results": [ { "name": "CACHI2_ARTIFACT", "type": "string", "value": "" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74" } ], "spanContext": { "traceparent": "00-2478d72c89567a3a5a71a1aa38c4ecde-6cf29a3258f444a5-01" }, "startTime": "2026-05-19T11:41:22Z", "steps": [ { "container": "step-skip-ta", "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "provenance": {}, "terminated": { "containerID": "cri-o://321b03a81abb6d2e7e2ad2b8039fc8ad3bb7aa42e4b1103beb0f647c77dd3489", "exitCode": 0, "finishedAt": "2026-05-19T11:41:27Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:27Z" }, "terminationReason": "Completed" }, { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://035221f0869218d0f659b685d5c8e41a645981ebc4445994c43b374eb1f514ca", "exitCode": 0, "finishedAt": "2026-05-19T11:41:27Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:27Z" }, "terminationReason": "Completed" }, { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "provenance": {}, "terminated": { "containerID": "cri-o://5bc1041c6d5302cb19310c6e7ebb09088eb7aaf7c35db99dbb693dc7960fb595", "exitCode": 0, "finishedAt": "2026-05-19T11:41:59Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:27Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://6349f8b583af02ed6daf1f7610ff87f6fcf45e889e1b2857384621b301b23058", "exitCode": 0, "finishedAt": "2026-05-19T11:41:59Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:59Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" } ], "results": [ { "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "computeResources": {}, "env": [ { "name": "INPUT" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74" } ], "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n mkdir -p /var/workdir/source\n mkdir -p /var/workdir/cachi2\n echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n" }, { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74=/var/workdir/source" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/var/workdir/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/var/workdir/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY", "value": "/workspace/git-basic-auth" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" } ], "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716.prefetch", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source", "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "emptyDir": {}, "name": "config" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/commit_sha": "4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uilbnm", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537094607", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-s6q6q", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2/records/12c2bcce-8ad6-4619-b3a1-94ffa20146a8", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db1dcf7d8e317492d30931804712ebee-1937a66fb4462c8d-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:36:07Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRunUID": "a6fd6532-085f-49d9-8167-57532fd6ecd2", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-4a2a2be585514454a0d63daa59818ab1-prefetch-dependencies", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "uid": "a6fd6532-085f-49d9-8167-57532fd6ecd2" } ], "resourceVersion": "82610", "uid": "12c2bcce-8ad6-4619-b3a1-94ffa20146a8" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808.prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "6h" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "git-basic-auth", "secret": { "secretName": "pac-gitauth-uilbnm" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:36:46Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:36:46Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-4a2a2be585514454a0d78236465519014b866e7e38e5a93de9-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, "entryPoint": "prefetch-dependencies-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min" } }, "results": [ { "name": "CACHI2_ARTIFACT", "type": "string", "value": "" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929" } ], "spanContext": { "traceparent": "00-db1dcf7d8e317492d30931804712ebee-1937a66fb4462c8d-01" }, "startTime": "2026-05-19T11:36:07Z", "steps": [ { "container": "step-skip-ta", "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "provenance": {}, "terminated": { "containerID": "cri-o://c2548df9550ae2a7c9264f97244dac6f764bc8220430217ac4a905532a948414", "exitCode": 0, "finishedAt": "2026-05-19T11:36:12Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:36:12Z" }, "terminationReason": "Completed" }, { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://9b42883d753d7cd8860061a15d456bc936ae288396f35663d52b1e1de0f5d7de", "exitCode": 0, "finishedAt": "2026-05-19T11:36:12Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:36:12Z" }, "terminationReason": "Completed" }, { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "provenance": {}, "terminated": { "containerID": "cri-o://8388ae8744ea0b8e704b2d5a6e5adb9428c8348a7034fc4c38a2b14801ddedde", "exitCode": 0, "finishedAt": "2026-05-19T11:36:45Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:36:12Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://19ec9ec73aeed265c356c4554859bbf2188c6de290797ea1ad5c06ed968f5e72", "exitCode": 0, "finishedAt": "2026-05-19T11:36:45Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:36:45Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" } ], "results": [ { "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "computeResources": {}, "env": [ { "name": "INPUT" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929" } ], "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n mkdir -p /var/workdir/source\n mkdir -p /var/workdir/cachi2\n echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n" }, { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929=/var/workdir/source" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/var/workdir/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/var/workdir/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY", "value": "/workspace/git-basic-auth" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" } ], "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808.prefetch", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source", "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "emptyDir": {}, "name": "config" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/commit_sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gsjcir", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537109186", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-7g9x2", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee/records/6c954658-023a-4b14-808b-8a3c6108d935", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}", "results.tekton.dev/result": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8511962eff22b59cfd9661580edff4f0-2d560cc3362ada80-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:40:20Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRunUID": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-51f41fbdd6a4d2cd9bf9d1199bdc0f8c-prefetch-dependencies", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "uid": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee" } ], "resourceVersion": "88548", "uid": "6c954658-023a-4b14-808b-8a3c6108d935" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0.prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "6h" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "git-basic-auth", "secret": { "secretName": "pac-gitauth-gsjcir" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:41:00Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:41:00Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-51f41fbdd6a4d2cd9bee92b4eace12b1c5c11777cb667b0df7-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, "entryPoint": "prefetch-dependencies-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min" } }, "results": [ { "name": "CACHI2_ARTIFACT", "type": "string", "value": "" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a" } ], "spanContext": { "traceparent": "00-8511962eff22b59cfd9661580edff4f0-2d560cc3362ada80-01" }, "startTime": "2026-05-19T11:40:20Z", "steps": [ { "container": "step-skip-ta", "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "provenance": {}, "terminated": { "containerID": "cri-o://dc73181a90563e8a3f0dba259d8ec868ec29b7b25496cd400ed28e70da380bb4", "exitCode": 0, "finishedAt": "2026-05-19T11:40:26Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:26Z" }, "terminationReason": "Completed" }, { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://bd0c009988bf66a6c17cef928c15c958e28a026448765ccf5fa4e6db76366cb5", "exitCode": 0, "finishedAt": "2026-05-19T11:40:26Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:26Z" }, "terminationReason": "Completed" }, { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "provenance": {}, "terminated": { "containerID": "cri-o://b3e8b95e51f76ef23e4dc8d49f0f4e6644bf6dc41f9233e98e14b01f394365d9", "exitCode": 0, "finishedAt": "2026-05-19T11:40:59Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:26Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://05d49b62d32a076762eae73808d5bfd4a7af644933818b25ff7935f778b334f1", "exitCode": 0, "finishedAt": "2026-05-19T11:40:59Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:59Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" } ], "results": [ { "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "computeResources": {}, "env": [ { "name": "INPUT" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a" } ], "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n mkdir -p /var/workdir/source\n mkdir -p /var/workdir/cachi2\n echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n" }, { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a=/var/workdir/source" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/var/workdir/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/var/workdir/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY", "value": "/workspace/git-basic-auth" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" } ], "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0.prefetch", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source", "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "emptyDir": {}, "name": "config" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/commit_sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-efgczi", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537079501", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-pull-request-p8f29", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de/records/4d6993c8-3b05-4677-8dfe-d1e4dced79c0", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-660eee8a28dcd3f4219f7b9a24544a26-e6027576a4ccd73b-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-ozak" }, "creationTimestamp": "2026-05-19T11:30:31Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRunUID": "f15699a7-890e-44ed-894d-e491f912d6de", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "529787a3d31011e383e7ca8b1425806842b93c02ed7a11d2dfaa720615f604" }, "name": "gl-multi-538c768f343f6ebf90f8f9860f456015-prefetch-dependencies", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "uid": "f15699a7-890e-44ed-894d-e491f912d6de" } ], "resourceVersion": "73661", "uid": "4d6993c8-3b05-4677-8dfe-d1e4dced79c0" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc.prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "6h" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "git-basic-auth", "secret": { "secretName": "pac-gitauth-efgczi" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:31:14Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:31:14Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-538c768f343f6ebf9055d5e8f797893ba9f6b503bdf1a5933d-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, "entryPoint": "prefetch-dependencies-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min" } }, "results": [ { "name": "CACHI2_ARTIFACT", "type": "string", "value": "" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b" } ], "spanContext": { "traceparent": "00-660eee8a28dcd3f4219f7b9a24544a26-e6027576a4ccd73b-01" }, "startTime": "2026-05-19T11:30:31Z", "steps": [ { "container": "step-skip-ta", "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "provenance": {}, "terminated": { "containerID": "cri-o://30949272faa76ca097ec1f7f34e4b34df47a6321ade4298c68dee3423e550077", "exitCode": 0, "finishedAt": "2026-05-19T11:30:37Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:30:37Z" }, "terminationReason": "Completed" }, { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://c4c2491a5d00f2856e0953568d56b25d7c4c52810361f3aeaf7d681289efd582", "exitCode": 0, "finishedAt": "2026-05-19T11:30:37Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:30:37Z" }, "terminationReason": "Completed" }, { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "provenance": {}, "terminated": { "containerID": "cri-o://3ea389af877482c7fbcdafcb6c2b5cb34bc2c57ba08bd4c31c3caff5c42a296e", "exitCode": 0, "finishedAt": "2026-05-19T11:31:13Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:30:37Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://52191913f6f5c81b1537d7015db6d5cfe6908f58b09a7caae1bf99e396bf03f3", "exitCode": 0, "finishedAt": "2026-05-19T11:31:13Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:31:13Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" } ], "results": [ { "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "computeResources": {}, "env": [ { "name": "INPUT" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b" } ], "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n mkdir -p /var/workdir/source\n mkdir -p /var/workdir/cachi2\n echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n" }, { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b=/var/workdir/source" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/var/workdir/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/var/workdir/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY", "value": "/workspace/git-basic-auth" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" } ], "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc.prefetch", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source", "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "emptyDir": {}, "name": "config" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/commit_sha": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-rbxbrr", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111804", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-push-r8tjg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-ozak' into 'multi-component-parent-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f/records/c67a7c01-141b-4cb2-b653-21049f1a7126", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"1635086a67b70da955b6ec55379eba702eded716\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-2478d72c89567a3a5a71a1aa38c4ecde-9b54dc0d90e265d5-01\"}" }, "creationTimestamp": "2026-05-19T11:43:58Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRunUID": "308865f3-3843-4928-bc02-8eebfe5b4c5f", "tekton.dev/pipelineTask": "rpms-signature-scan", "tekton.dev/task": "rpms-signature-scan" }, "name": "gl-multi-co34ed2d3a1eea78cc09d0cab1648bcfe8-rpms-signature-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-push-r8tjg", "uid": "308865f3-3843-4928-bc02-8eebfe5b4c5f" } ], "resourceVersion": "93839", "uid": "c67a7c01-141b-4cb2-b653-21049f1a7126" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "image-digest", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:12Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:12Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-co34ed2d3a1eea78cc2bec6fe12d7b76fef47eee77f2e834e2-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, "entryPoint": "rpms-signature-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\", \"digests\": [\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\"]}}\n" }, { "name": "RPMS_DATA", "type": "string", "value": "{\"keys\": {\"199e2f91fd431d51\": 106, \"unsigned\": 0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:44:11+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-2478d72c89567a3a5a71a1aa38c4ecde-9b54dc0d90e265d5-01" }, "startTime": "2026-05-19T11:43:58Z", "steps": [ { "container": "step-rpms-signature-scan", "imageID": "quay.io/konflux-ci/tools@sha256:0d2fbb45b33949aa7474157b7cae3a55d3a399405fd8bef75dd73d0bee96890a", "name": "rpms-signature-scan", "provenance": {}, "terminated": { "containerID": "cri-o://f74a04cbea74ec97650ffff6e167277422d6454d5324292d7cdee710944d6221", "exitCode": 0, "finishedAt": "2026-05-19T11:44:10Z", "reason": "Completed", "startedAt": "2026-05-19T11:44:02Z" }, "terminationReason": "Completed" }, { "container": "step-output-results", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "provenance": {}, "terminated": { "containerID": "cri-o://55f8e0ace8a4afde0282b7ae5c3c125d143e0f645a255f040ca9880b38b52ef2", "exitCode": 0, "finishedAt": "2026-05-19T11:44:11Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\\\", \\\"digests\\\": [\\\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 106, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:11+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:11Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans RPMs in an image and provide information about RPMs signatures.", "params": [ { "description": "Image URL", "name": "image-url", "type": "string" }, { "description": "Image digest to scan", "name": "image-digest", "type": "string" }, { "default": "/tmp", "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n", "name": "workdir", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Information about signed and unsigned RPMs", "name": "RPMS_DATA", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "200m", "memory": "256Mi" }, "requests": { "cpu": "200m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "IMAGE_DIGEST", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/tools@sha256:cdab2b0f6e01ed7852ad4c5376fd58bdbfe0db1379dd5acf42aad722a0f1e168", "name": "rpms-signature-scan", "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n --image-url \"${IMAGE_URL}\" \\\n --image-digest \"${IMAGE_DIGEST}\" \\\n --workdir \"${WORKDIR}\" \\\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "50m", "memory": "32Mi" }, "requests": { "cpu": "50m", "memory": "32Mi" } }, "env": [ { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/commit_sha": "4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uilbnm", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537094607", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-s6q6q", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2/records/e041bb07-2fad-4f8a-ae26-fbd1f19621e5", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db1dcf7d8e317492d30931804712ebee-f357343ccfcdf8f7-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:38:54Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRunUID": "a6fd6532-085f-49d9-8167-57532fd6ecd2", "tekton.dev/pipelineTask": "rpms-signature-scan", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-co4a2a2be585514454a0d63daa59818ab1-rpms-signature-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "uid": "a6fd6532-085f-49d9-8167-57532fd6ecd2" } ], "resourceVersion": "85671", "uid": "e041bb07-2fad-4f8a-ae26-fbd1f19621e5" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "image-digest", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:39:06Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:39:06Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-co4a2a2be5855144546d0951fc109b44c67724ef77f01146c0-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, "entryPoint": "rpms-signature-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\", \"digests\": [\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\"]}}\n" }, { "name": "RPMS_DATA", "type": "string", "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:39:06+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-db1dcf7d8e317492d30931804712ebee-f357343ccfcdf8f7-01" }, "startTime": "2026-05-19T11:38:55Z", "steps": [ { "container": "step-rpms-signature-scan", "imageID": "quay.io/konflux-ci/tools@sha256:0d2fbb45b33949aa7474157b7cae3a55d3a399405fd8bef75dd73d0bee96890a", "name": "rpms-signature-scan", "provenance": {}, "terminated": { "containerID": "cri-o://80222d327b77222be761670c1ca58c58d1841a5e952bf1902bf76120b63bc5d1", "exitCode": 0, "finishedAt": "2026-05-19T11:39:05Z", "reason": "Completed", "startedAt": "2026-05-19T11:38:58Z" }, "terminationReason": "Completed" }, { "container": "step-output-results", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "provenance": {}, "terminated": { "containerID": "cri-o://b23ef1b33a41b5fc4c6cc50b6a97249a21a595ebfbc823dcd178f870d9770ce4", "exitCode": 0, "finishedAt": "2026-05-19T11:39:06Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\\\", \\\"digests\\\": [\\\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:39:06+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:39:06Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans RPMs in an image and provide information about RPMs signatures.", "params": [ { "description": "Image URL", "name": "image-url", "type": "string" }, { "description": "Image digest to scan", "name": "image-digest", "type": "string" }, { "default": "/tmp", "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n", "name": "workdir", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Information about signed and unsigned RPMs", "name": "RPMS_DATA", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "200m", "memory": "256Mi" }, "requests": { "cpu": "200m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "IMAGE_DIGEST", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/tools@sha256:cdab2b0f6e01ed7852ad4c5376fd58bdbfe0db1379dd5acf42aad722a0f1e168", "name": "rpms-signature-scan", "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n --image-url \"${IMAGE_URL}\" \\\n --image-digest \"${IMAGE_DIGEST}\" \\\n --workdir \"${WORKDIR}\" \\\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "50m", "memory": "32Mi" }, "requests": { "cpu": "50m", "memory": "32Mi" } }, "env": [ { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/commit_sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gsjcir", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537109186", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-7g9x2", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee/records/c619a89e-0f0d-4506-9c2f-3980b89b5be0", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}", "results.tekton.dev/result": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8511962eff22b59cfd9661580edff4f0-dfaca5f1b357b59d-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:43:08Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRunUID": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "tekton.dev/pipelineTask": "rpms-signature-scan", "tekton.dev/task": "rpms-signature-scan", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-co51f41fbdd6a4d2cd9bf9d1199bdc0f8c-rpms-signature-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "uid": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee" } ], "resourceVersion": "92250", "uid": "c619a89e-0f0d-4506-9c2f-3980b89b5be0" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "image-digest", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:23Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:23Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-co51f41fbdd6a4d2cd93df5ee7c5ed83e9cd83394bb7fbf72c-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, "entryPoint": "rpms-signature-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\", \"digests\": [\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\"]}}\n" }, { "name": "RPMS_DATA", "type": "string", "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:43:22+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-8511962eff22b59cfd9661580edff4f0-dfaca5f1b357b59d-01" }, "startTime": "2026-05-19T11:43:09Z", "steps": [ { "container": "step-rpms-signature-scan", "imageID": "quay.io/konflux-ci/tools@sha256:0d2fbb45b33949aa7474157b7cae3a55d3a399405fd8bef75dd73d0bee96890a", "name": "rpms-signature-scan", "provenance": {}, "terminated": { "containerID": "cri-o://46a872ff280f44010c65dc3378f92fd2fbd9850c764cb7c09495c819f21f4538", "exitCode": 0, "finishedAt": "2026-05-19T11:43:21Z", "reason": "Completed", "startedAt": "2026-05-19T11:43:14Z" }, "terminationReason": "Completed" }, { "container": "step-output-results", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "provenance": {}, "terminated": { "containerID": "cri-o://45c4998abf2ae6988c72f6e3fc234434983998d19718961dae496655eae408d6", "exitCode": 0, "finishedAt": "2026-05-19T11:43:22Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\\\", \\\"digests\\\": [\\\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:22+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:22Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans RPMs in an image and provide information about RPMs signatures.", "params": [ { "description": "Image URL", "name": "image-url", "type": "string" }, { "description": "Image digest to scan", "name": "image-digest", "type": "string" }, { "default": "/tmp", "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n", "name": "workdir", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Information about signed and unsigned RPMs", "name": "RPMS_DATA", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "200m", "memory": "256Mi" }, "requests": { "cpu": "200m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "IMAGE_DIGEST", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/tools@sha256:cdab2b0f6e01ed7852ad4c5376fd58bdbfe0db1379dd5acf42aad722a0f1e168", "name": "rpms-signature-scan", "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n --image-url \"${IMAGE_URL}\" \\\n --image-digest \"${IMAGE_DIGEST}\" \\\n --workdir \"${WORKDIR}\" \\\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "50m", "memory": "32Mi" }, "requests": { "cpu": "50m", "memory": "32Mi" } }, "env": [ { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/commit_sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-efgczi", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537079501", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-pull-request-p8f29", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de/records/9e60352d-836f-4364-bbbe-0b05f5bcedad", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-660eee8a28dcd3f4219f7b9a24544a26-ba55bb2f991af86b-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-ozak" }, "creationTimestamp": "2026-05-19T11:34:12Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRunUID": "f15699a7-890e-44ed-894d-e491f912d6de", "tekton.dev/pipelineTask": "rpms-signature-scan", "tekton.dev/task": "rpms-signature-scan", "test.appstudio.openshift.io/pr-group-sha": "529787a3d31011e383e7ca8b1425806842b93c02ed7a11d2dfaa720615f604" }, "name": "gl-multi-co538c768f343f6ebf90f8f9860f456015-rpms-signature-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "uid": "f15699a7-890e-44ed-894d-e491f912d6de" } ], "resourceVersion": "79404", "uid": "9e60352d-836f-4364-bbbe-0b05f5bcedad" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "image-digest", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:28Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:28Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-co538c768f343f6ebfa3cdfdddefc443051ff0d5a2cf9aaaf9-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, "entryPoint": "rpms-signature-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\", \"digests\": [\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\"]}}\n" }, { "name": "RPMS_DATA", "type": "string", "value": "{\"keys\": {\"199e2f91fd431d51\": 106, \"unsigned\": 0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:34:28+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-660eee8a28dcd3f4219f7b9a24544a26-ba55bb2f991af86b-01" }, "startTime": "2026-05-19T11:34:12Z", "steps": [ { "container": "step-rpms-signature-scan", "imageID": "quay.io/konflux-ci/tools@sha256:0d2fbb45b33949aa7474157b7cae3a55d3a399405fd8bef75dd73d0bee96890a", "name": "rpms-signature-scan", "provenance": {}, "terminated": { "containerID": "cri-o://98df5fea39cbd1a794de485e02749fbec930fed4da2916fd9e3f4fe62565d2fd", "exitCode": 0, "finishedAt": "2026-05-19T11:34:26Z", "reason": "Completed", "startedAt": "2026-05-19T11:34:18Z" }, "terminationReason": "Completed" }, { "container": "step-output-results", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "provenance": {}, "terminated": { "containerID": "cri-o://bd5af63bb08b89cc4d588a2a66b1cde7f36d7010e0f55772ca87c351f6c2ccbf", "exitCode": 0, "finishedAt": "2026-05-19T11:34:28Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\\\", \\\"digests\\\": [\\\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 106, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:28+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:27Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans RPMs in an image and provide information about RPMs signatures.", "params": [ { "description": "Image URL", "name": "image-url", "type": "string" }, { "description": "Image digest to scan", "name": "image-digest", "type": "string" }, { "default": "/tmp", "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n", "name": "workdir", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Information about signed and unsigned RPMs", "name": "RPMS_DATA", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "200m", "memory": "256Mi" }, "requests": { "cpu": "200m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "IMAGE_DIGEST", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/tools@sha256:cdab2b0f6e01ed7852ad4c5376fd58bdbfe0db1379dd5acf42aad722a0f1e168", "name": "rpms-signature-scan", "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n --image-url \"${IMAGE_URL}\" \\\n --image-digest \"${IMAGE_DIGEST}\" \\\n --workdir \"${WORKDIR}\" \\\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "50m", "memory": "32Mi" }, "requests": { "cpu": "50m", "memory": "32Mi" } }, "env": [ { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/commit_sha": "4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uilbnm", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537094607", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-s6q6q", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2/records/bd1814dc-a612-40f6-81bc-2a0bdaf4628e", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db1dcf7d8e317492d30931804712ebee-1a57fe9e0fffe875-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:38:54Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRunUID": "a6fd6532-085f-49d9-8167-57532fd6ecd2", "tekton.dev/pipelineTask": "sast-unicode-check", "tekton.dev/task": "sast-unicode-check-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-com4a2a2be585514454a0d63daa59818ab1-sast-unicode-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "uid": "a6fd6532-085f-49d9-8167-57532fd6ecd2" } ], "resourceVersion": "85575", "uid": "bd1814dc-a612-40f6-81bc-2a0bdaf4628e" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:39:03Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:39:03Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-com4a2a2be585514455b6a8232fcf618050c8b9b809161f04d-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, "entryPoint": "sast-unicode-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:39:01+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-db1dcf7d8e317492d30931804712ebee-1a57fe9e0fffe875-01" }, "startTime": "2026-05-19T11:38:54Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://f6e5e5f1e7843eed628944114aeee2f8e861481fda33f919e6865e9ebfdfe522", "exitCode": 0, "finishedAt": "2026-05-19T11:39:00Z", "reason": "Completed", "startedAt": "2026-05-19T11:39:00Z" }, "terminationReason": "Completed" }, { "container": "step-sast-unicode-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-unicode-check", "provenance": {}, "terminated": { "containerID": "cri-o://60bd08f3b7485607f2340b2790dbe8deb64be2ed0ea5d7eaaad973353beb4280", "exitCode": 0, "finishedAt": "2026-05-19T11:39:01Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:39:01+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:39:00Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://d29fbac82ddc9679ddef06ec319cc13a782811509f555e7294baf5f48d3541c7", "exitCode": 0, "finishedAt": "2026-05-19T11:39:02Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:39:01+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:39:02Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans source code for non-printable unicode characters in all text files.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "-p bidi -v -d -t", "description": "arguments for find-unicode-control command.", "name": "FIND_UNICODE_CONTROL_ARGS", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "description": "Image digest used for ORAS upload.", "name": "image-digest", "type": "string" }, { "description": "Image URL used for ORAS upload.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "FIND_UNICODE_CONTROL_ARGS", "value": "-p bidi -v -d -t" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_CODE_DIR", "value": "/var/workdir" }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-unicode-check", "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n \u003eraw_sast_unicode_check_out.txt \\\n 2\u003eraw_sast_unicode_check_out.log ||\n FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n echo \"Failed to run find-unicode-control command\" \u003e\u00262\n cat raw_sast_unicode_check_out.log\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n --mode=json\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"${SCAN_PROP}\"\n --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n cat processed_sast_unicode_check_out.err\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # Build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n # Append --record-excluded option if RECORD_EXCLUDED is true\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n else\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n echo \"sast-unicode-check test failed because of the following issues:\"\n cat sast_unicode_check_out.json\n TEST_OUTPUT=\n parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "IMAGE_DIGEST", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n echo 'No image-url param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n MEDIA_TYPE=application/json\n else\n MEDIA_TYPE=application/sarif+json\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/commit_sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gsjcir", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537109186", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-7g9x2", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee/records/0ddcd60b-484c-4816-9454-c2c45b126ea0", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}", "results.tekton.dev/result": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8511962eff22b59cfd9661580edff4f0-fedfbbb29d41b799-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:43:08Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRunUID": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "tekton.dev/pipelineTask": "sast-unicode-check", "tekton.dev/task": "sast-unicode-check-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-com51f41fbdd6a4d2cd9bf9d1199bdc0f8c-sast-unicode-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "uid": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee" } ], "resourceVersion": "92165", "uid": "0ddcd60b-484c-4816-9454-c2c45b126ea0" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:17Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:17Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-com51f41fbdd6a4d2c7a44c0d8d0761551830aa84f60a0d84c-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, "entryPoint": "sast-unicode-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:43:15+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-8511962eff22b59cfd9661580edff4f0-fedfbbb29d41b799-01" }, "startTime": "2026-05-19T11:43:08Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://f879f4620cd256350f53672b91dd353ff28f86da7654ad21c2d7330e0da00d7d", "exitCode": 0, "finishedAt": "2026-05-19T11:43:13Z", "reason": "Completed", "startedAt": "2026-05-19T11:43:13Z" }, "terminationReason": "Completed" }, { "container": "step-sast-unicode-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-unicode-check", "provenance": {}, "terminated": { "containerID": "cri-o://1e650e7c5e42286b5a12e6b62719284805a9b04700604970390e11e6f4d1d41a", "exitCode": 0, "finishedAt": "2026-05-19T11:43:15Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:15+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:14Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://7d23c408780280908f0097b50fcfa8a6a2afe26a3d3be989ae58234e68c6650a", "exitCode": 0, "finishedAt": "2026-05-19T11:43:16Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:15+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:16Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans source code for non-printable unicode characters in all text files.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "-p bidi -v -d -t", "description": "arguments for find-unicode-control command.", "name": "FIND_UNICODE_CONTROL_ARGS", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "description": "Image digest used for ORAS upload.", "name": "image-digest", "type": "string" }, { "description": "Image URL used for ORAS upload.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "FIND_UNICODE_CONTROL_ARGS", "value": "-p bidi -v -d -t" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_CODE_DIR", "value": "/var/workdir" }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-unicode-check", "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n \u003eraw_sast_unicode_check_out.txt \\\n 2\u003eraw_sast_unicode_check_out.log ||\n FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n echo \"Failed to run find-unicode-control command\" \u003e\u00262\n cat raw_sast_unicode_check_out.log\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n --mode=json\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"${SCAN_PROP}\"\n --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n cat processed_sast_unicode_check_out.err\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # Build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n # Append --record-excluded option if RECORD_EXCLUDED is true\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n else\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n echo \"sast-unicode-check test failed because of the following issues:\"\n cat sast_unicode_check_out.json\n TEST_OUTPUT=\n parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "IMAGE_DIGEST", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n echo 'No image-url param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n MEDIA_TYPE=application/json\n else\n MEDIA_TYPE=application/sarif+json\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/commit_sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-efgczi", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537079501", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-pull-request-p8f29", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de/records/4482b33f-ca81-4594-8019-5fd15d2a0a90", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-660eee8a28dcd3f4219f7b9a24544a26-278f3cfc107ef24e-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-ozak" }, "creationTimestamp": "2026-05-19T11:34:12Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRunUID": "f15699a7-890e-44ed-894d-e491f912d6de", "tekton.dev/pipelineTask": "sast-unicode-check", "tekton.dev/task": "sast-unicode-check-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "529787a3d31011e383e7ca8b1425806842b93c02ed7a11d2dfaa720615f604" }, "name": "gl-multi-com538c768f343f6ebf90f8f9860f456015-sast-unicode-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "uid": "f15699a7-890e-44ed-894d-e491f912d6de" } ], "resourceVersion": "79128", "uid": "4482b33f-ca81-4594-8019-5fd15d2a0a90" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:22Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:22Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-com538c768f343f6eb3dd0cf33bddfd37796c6f4bc3d0e0bbd-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, "entryPoint": "sast-unicode-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:34:20+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-660eee8a28dcd3f4219f7b9a24544a26-278f3cfc107ef24e-01" }, "startTime": "2026-05-19T11:34:12Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://250754176b236aff44939b6cce75cebe2fef2a42c74761a1f81b1d833c1e5a61", "exitCode": 0, "finishedAt": "2026-05-19T11:34:19Z", "reason": "Completed", "startedAt": "2026-05-19T11:34:18Z" }, "terminationReason": "Completed" }, { "container": "step-sast-unicode-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-unicode-check", "provenance": {}, "terminated": { "containerID": "cri-o://f7621dea4d669c103b3702328333e54cadc06ca323dfb6ec7e06350383ff5817", "exitCode": 0, "finishedAt": "2026-05-19T11:34:20Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:20+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:20Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://99f6e98f9260007cf8ca06376b8e15997cc2a0d943728d44d877dd07c82f7456", "exitCode": 0, "finishedAt": "2026-05-19T11:34:22Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:20+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:21Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans source code for non-printable unicode characters in all text files.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "-p bidi -v -d -t", "description": "arguments for find-unicode-control command.", "name": "FIND_UNICODE_CONTROL_ARGS", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "description": "Image digest used for ORAS upload.", "name": "image-digest", "type": "string" }, { "description": "Image URL used for ORAS upload.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "FIND_UNICODE_CONTROL_ARGS", "value": "-p bidi -v -d -t" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_CODE_DIR", "value": "/var/workdir" }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-unicode-check", "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n \u003eraw_sast_unicode_check_out.txt \\\n 2\u003eraw_sast_unicode_check_out.log ||\n FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n echo \"Failed to run find-unicode-control command\" \u003e\u00262\n cat raw_sast_unicode_check_out.log\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n --mode=json\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"${SCAN_PROP}\"\n --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n cat processed_sast_unicode_check_out.err\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # Build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n # Append --record-excluded option if RECORD_EXCLUDED is true\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n else\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n echo \"sast-unicode-check test failed because of the following issues:\"\n cat sast_unicode_check_out.json\n TEST_OUTPUT=\n parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "IMAGE_DIGEST", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n echo 'No image-url param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n MEDIA_TYPE=application/json\n else\n MEDIA_TYPE=application/sarif+json\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/commit_sha": "4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uilbnm", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537094607", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-s6q6q", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2/records/eac0f549-b496-4cca-9198-b15b3d87dfee", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db1dcf7d8e317492d30931804712ebee-173576e2e6919325-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:38:43Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRunUID": "a6fd6532-085f-49d9-8167-57532fd6ecd2", "tekton.dev/pipelineTask": "build-image-index", "tekton.dev/task": "build-image-index-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-comp4a2a2be585514454a0d63daa59818ab1-build-image-index", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "uid": "a6fd6532-085f-49d9-8167-57532fd6ecd2" } ], "resourceVersion": "85446", "uid": "eac0f549-b496-4cca-9198-b15b3d87dfee" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:38:54Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:38:54Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-comp4a2a2be585514453a5c3494bd2912a1d5c22edd987162d-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, "entryPoint": "build-image-index-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min" } }, "results": [ { "name": "IMAGES", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" } ], "spanContext": { "traceparent": "00-db1dcf7d8e317492d30931804712ebee-173576e2e6919325-01" }, "startTime": "2026-05-19T11:38:43Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://982f0853151598842916aad5d76e42fd57aec6b2e5abdd0ceeb0bc6c64dbb379", "exitCode": 0, "finishedAt": "2026-05-19T11:38:51Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:38:48Z" }, "terminationReason": "Completed" }, { "container": "step-create-sbom", "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://47bca7ca11aee0b2a7d2a87cc9109c774b323d8c88dc77c1e5caf78009f39909", "exitCode": 0, "finishedAt": "2026-05-19T11:38:51Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:38:51Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://03be72f4440b88f0fbe4b0af859149696dc2d00a5461c488e47493bd81aebcef", "exitCode": 0, "finishedAt": "2026-05-19T11:38:54Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:38:52Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This takes existing Image Manifests and combines them in an Image Index.", "params": [ { "description": "The target image and tag where the image will be pushed to.", "name": "IMAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "description": "List of Image Manifests to be referenced by the Image Index", "name": "IMAGES", "type": "array" }, { "default": "true", "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.", "name": "ALWAYS_BUILD_INDEX", "type": "string" }, { "default": "vfs", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": "false", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "List of all referenced image manifests", "name": "IMAGES", "type": "string" }, { "description": "Image reference of the built image containing both the repository and the digest", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "vfs" } ], "volumeMounts": [ { "mountPath": "/index-build-data", "name": "shared-dir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n --image \"$IMAGE\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --buildah-format \"$BUILDAH_FORMAT\" \\\n --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n --additional-tags \"gl-multi-comp4a2a2be585514454a0d63daa59818ab1-build-image-index\" \\\n --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n --result-path-images \"/tekton/results/IMAGES\" \\\n --images \"$@\"; then\n echo \"Failed to build image index\"\n exit 1\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-index\n --index-image-pullspec \"$IMAGE_URL\"\n --index-image-digest \"$IMAGE_DIGEST\"\n --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 } } ], "volumes": [ { "emptyDir": {}, "name": "shared-dir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/commit_sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gsjcir", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537109186", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-7g9x2", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee/records/24847701-1138-4bf3-a66b-e06d657ebe6c", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}", "results.tekton.dev/result": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8511962eff22b59cfd9661580edff4f0-c170393166593029-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:42:57Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRunUID": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "tekton.dev/pipelineTask": "build-image-index", "tekton.dev/task": "build-image-index-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-comp51f41fbdd6a4d2cd9bf9d1199bdc0f8c-build-image-index", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "uid": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee" } ], "resourceVersion": "91973", "uid": "24847701-1138-4bf3-a66b-e06d657ebe6c" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:08Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:08Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-comp51f41fbdd6a4d26fbb31dc633e3a42ac90aef3efc29137-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, "entryPoint": "build-image-index-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min" } }, "results": [ { "name": "IMAGES", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" } ], "spanContext": { "traceparent": "00-8511962eff22b59cfd9661580edff4f0-c170393166593029-01" }, "startTime": "2026-05-19T11:42:57Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://2542f3332a3093455ff77fbd410f902196cefc95ff246477d1c2c863b0945ff8", "exitCode": 0, "finishedAt": "2026-05-19T11:43:04Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:02Z" }, "terminationReason": "Completed" }, { "container": "step-create-sbom", "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://b51aaebbec89d9a64de0261ec7e67b8c4f1e3241f24b802ab7dac2597b7e475f", "exitCode": 0, "finishedAt": "2026-05-19T11:43:05Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:05Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://d5e7f5cac2e7cb0a1948075fc38cde8c0a03a5d10b86403af13f4c2983851fb1", "exitCode": 0, "finishedAt": "2026-05-19T11:43:07Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:05Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This takes existing Image Manifests and combines them in an Image Index.", "params": [ { "description": "The target image and tag where the image will be pushed to.", "name": "IMAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "description": "List of Image Manifests to be referenced by the Image Index", "name": "IMAGES", "type": "array" }, { "default": "true", "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.", "name": "ALWAYS_BUILD_INDEX", "type": "string" }, { "default": "vfs", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": "false", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "List of all referenced image manifests", "name": "IMAGES", "type": "string" }, { "description": "Image reference of the built image containing both the repository and the digest", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "vfs" } ], "volumeMounts": [ { "mountPath": "/index-build-data", "name": "shared-dir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n --image \"$IMAGE\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --buildah-format \"$BUILDAH_FORMAT\" \\\n --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n --additional-tags \"gl-multi-comp51f41fbdd6a4d2cd9bf9d1199bdc0f8c-build-image-index\" \\\n --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n --result-path-images \"/tekton/results/IMAGES\" \\\n --images \"$@\"; then\n echo \"Failed to build image index\"\n exit 1\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-index\n --index-image-pullspec \"$IMAGE_URL\"\n --index-image-digest \"$IMAGE_DIGEST\"\n --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 } } ], "volumes": [ { "emptyDir": {}, "name": "shared-dir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/commit_sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-efgczi", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537079501", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-pull-request-p8f29", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de/records/faa26407-fbd2-4940-80a0-65592ab9bc6e", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-660eee8a28dcd3f4219f7b9a24544a26-2dead0b8dae1c60d-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-ozak" }, "creationTimestamp": "2026-05-19T11:34:01Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRunUID": "f15699a7-890e-44ed-894d-e491f912d6de", "tekton.dev/pipelineTask": "build-image-index", "tekton.dev/task": "build-image-index-min", "test.appstudio.openshift.io/pr-group-sha": "529787a3d31011e383e7ca8b1425806842b93c02ed7a11d2dfaa720615f604" }, "name": "gl-multi-comp538c768f343f6ebf90f8f9860f456015-build-image-index", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "uid": "f15699a7-890e-44ed-894d-e491f912d6de" } ], "resourceVersion": "78476", "uid": "faa26407-fbd2-4940-80a0-65592ab9bc6e" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:11Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:11Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-comp538c768f343f6ed517e5d17f08deb00e2df26f75b1ccc9-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, "entryPoint": "build-image-index-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min" } }, "results": [ { "name": "IMAGES", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" } ], "spanContext": { "traceparent": "00-660eee8a28dcd3f4219f7b9a24544a26-2dead0b8dae1c60d-01" }, "startTime": "2026-05-19T11:34:01Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://23e017389c670662c53b4fabc5fe8b6c07917eb1743b2358f6a8522c773b5b3a", "exitCode": 0, "finishedAt": "2026-05-19T11:34:08Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:06Z" }, "terminationReason": "Completed" }, { "container": "step-create-sbom", "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://69346ae18336be1862a54fdd31a891d15b108d648b23039278de496578ee3ed1", "exitCode": 0, "finishedAt": "2026-05-19T11:34:08Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:08Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://f2e6dbc658aca875467cc0eebb35fb11180bd0c97db2561a117fd017c6a6dd9d", "exitCode": 0, "finishedAt": "2026-05-19T11:34:11Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:08Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This takes existing Image Manifests and combines them in an Image Index.", "params": [ { "description": "The target image and tag where the image will be pushed to.", "name": "IMAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "description": "List of Image Manifests to be referenced by the Image Index", "name": "IMAGES", "type": "array" }, { "default": "true", "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.", "name": "ALWAYS_BUILD_INDEX", "type": "string" }, { "default": "vfs", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": "false", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "List of all referenced image manifests", "name": "IMAGES", "type": "string" }, { "description": "Image reference of the built image containing both the repository and the digest", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "vfs" } ], "volumeMounts": [ { "mountPath": "/index-build-data", "name": "shared-dir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n --image \"$IMAGE\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --buildah-format \"$BUILDAH_FORMAT\" \\\n --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n --additional-tags \"gl-multi-comp538c768f343f6ebf90f8f9860f456015-build-image-index\" \\\n --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n --result-path-images \"/tekton/results/IMAGES\" \\\n --images \"$@\"; then\n echo \"Failed to build image index\"\n exit 1\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-index\n --index-image-pullspec \"$IMAGE_URL\"\n --index-image-digest \"$IMAGE_DIGEST\"\n --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 } } ], "volumes": [ { "emptyDir": {}, "name": "shared-dir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/commit_sha": "4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uilbnm", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537094607", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-s6q6q", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2/records/27a45432-5777-458d-a744-7cb7bde34873", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone oci trusted artifacts", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db1dcf7d8e317492d30931804712ebee-2490d34601aada91-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:35:58Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRunUID": "a6fd6532-085f-49d9-8167-57532fd6ecd2", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-compo4a2a2be585514454a0d63daa59818ab1-clone-repository", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "uid": "a6fd6532-085f-49d9-8167-57532fd6ecd2" } ], "resourceVersion": "81867", "uid": "27a45432-5777-458d-a744-7cb7bde34873" }, "spec": { "params": [ { "name": "url", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "revision", "value": "4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808.git" }, { "name": "ociArtifactExpiresAfter", "value": "6h" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "basic-auth", "secret": { "secretName": "pac-gitauth-uilbnm" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:36:07Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:36:07Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-compo4a2a2be585514cdc92e99f08029d27293991bedf464ca-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, "entryPoint": "git-clone-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "commit", "type": "string", "value": "4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "commit-timestamp", "type": "string", "value": "1779190539" }, { "name": "short-commit", "type": "string", "value": "4072b1e" }, { "name": "url", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929" } ], "spanContext": { "traceparent": "00-db1dcf7d8e317492d30931804712ebee-2490d34601aada91-01" }, "startTime": "2026-05-19T11:35:58Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "provenance": {}, "terminated": { "containerID": "cri-o://1e1da0999a9015e55d68f621577a7706d7ce48ebd365ae4817b1cadc5dc3aca8", "exitCode": 0, "finishedAt": "2026-05-19T11:36:05Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190539\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"4072b1e\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:36:04Z" }, "terminationReason": "Completed" }, { "container": "step-symlink-check", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "provenance": {}, "terminated": { "containerID": "cri-o://154eb33f83c01f0764669daea633684ce52b6a0289cf3c2aa14ab4ae6b74fc60", "exitCode": 0, "finishedAt": "2026-05-19T11:36:05Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190539\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"4072b1e\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:36:05Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://70343224cbca72b07bebea59a320988c344095dde845fc838f94735cee551ae5", "exitCode": 0, "finishedAt": "2026-05-19T11:36:06Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929\",\"type\":1},{\"key\":\"commit\",\"value\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190539\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"4072b1e\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:36:05Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.", "params": [ { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "7", "description": "Length of short commit SHA", "name": "shortCommitLength", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n", "name": "submodulePaths", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "/tekton/home", "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n", "name": "userHome", "type": "string" }, { "default": "false", "description": "Log the commands that are executed during `git-clone`'s operation.", "name": "verbose", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" }, { "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" } ], "steps": [ { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "PARAM_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "PARAM_REVISION", "value": "4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "PARAM_REFSPEC" }, { "name": "PARAM_SUBMODULES", "value": "true" }, { "name": "PARAM_SUBMODULE_PATHS" }, { "name": "PARAM_DEPTH", "value": "1" }, { "name": "PARAM_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "PARAM_SSL_VERIFY", "value": "true" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "PARAM_VERBOSE", "value": "false" }, { "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "PARAM_USER_HOME", "value": "/tekton/home" }, { "name": "PARAM_FETCH_TAGS", "value": "false" }, { "name": "PARAM_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "PARAM_TARGET_BRANCH", "value": "main" }, { "name": "PARAM_MERGE_SOURCE_REPO_URL" }, { "name": "PARAM_MERGE_SOURCE_DEPTH" }, { "name": "WORKSPACE_SSH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_SSH_DIRECTORY_PATH" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND", "value": "true" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH", "value": "/workspace/basic-auth" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n # Compatibility with kubernetes.io/basic-auth secrets\n elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n else\n echo \"Unknown basic-auth workspace format\"\n exit 1\n fi\n chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n -url=\"${PARAM_URL}\" \\\n -revision=\"${PARAM_REVISION}\" \\\n -refspec=\"${PARAM_REFSPEC}\" \\\n -path=\"${CHECKOUT_DIR}\" \\\n -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n -submodules=\"${PARAM_SUBMODULES}\" \\\n -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n -depth=\"${PARAM_DEPTH}\" \\\n -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n # Determine if merging from a different repository or the same one\n if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n normalize_url() {\n echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n }\n\n NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n MERGE_REMOTE=\"origin\"\n else\n echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n echo \"Adding remote 'merge-source'...\"\n git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n MERGE_REMOTE=\"merge-source\"\n fi\n else\n echo \"Merging from the same repository (origin)\"\n MERGE_REMOTE=\"origin\"\n fi\n\n echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n else\n retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n fi\n\n echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n git config --global user.email \"tekton-git-clone@tekton.dev\"\n git config --global user.name \"Tekton Git Clone Task\"\n\n if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n echo \"--- Git Status ---\"\n git status\n echo \"------------------\"\n exit 1\n fi\n\n # Check if there are changes staged for commit\n if git diff --staged --quiet; then\n echo \"No diff was found, skipping merge...\" \u003e\u00262\n else\n echo \"Merge successful (no conflicts found), committing...\"\n if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n exit 1\n fi\n MERGED_SHA=$(git rev-parse HEAD)\n echo \"New HEAD after merge: ${MERGED_SHA}\"\n echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n fi\n\nelse\n echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n echo \"Fetching tags\"\n retry git fetch --tags\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "computeResources": {}, "env": [ { "name": "PARAM_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n while read -r symlink; do\n target=$(readlink -m \"$symlink\")\n if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n fi\n done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n return 1\n fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n echo \"Running symlink check\"\n check_symlinks\nfi\n", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808.git", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/commit_sha": "4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uilbnm", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537094607", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-s6q6q", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2/records/0ef7007f-ba70-4239-b9bb-19c882dbe7cc", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db1dcf7d8e317492d30931804712ebee-2b0b7fefbdda72f1-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:38:54Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRunUID": "a6fd6532-085f-49d9-8167-57532fd6ecd2", "tekton.dev/pipelineTask": "sast-shell-check", "tekton.dev/task": "sast-shell-check-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-compo4a2a2be585514454a0d63daa59818ab1-sast-shell-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "uid": "a6fd6532-085f-49d9-8167-57532fd6ecd2" } ], "resourceVersion": "85795", "uid": "0ef7007f-ba70-4239-b9bb-19c882dbe7cc" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-shell-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:39:12Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:39:12Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-compo4a2a2be58551441b9098a9b71acf2cf6f27a52179627b-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, "entryPoint": "sast-shell-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:39:10+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-db1dcf7d8e317492d30931804712ebee-2b0b7fefbdda72f1-01" }, "startTime": "2026-05-19T11:38:54Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://47d267461693756860f4ec249b74b212287f9744eea6eebb05d535cbdd922975", "exitCode": 0, "finishedAt": "2026-05-19T11:39:00Z", "reason": "Completed", "startedAt": "2026-05-19T11:39:00Z" }, "terminationReason": "Completed" }, { "container": "step-sast-shell-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-shell-check", "provenance": {}, "terminated": { "containerID": "cri-o://21e7997de4e3517e200c18080e8b17853b1bd11ea3ee9ed525ccc8e038ef4c8b", "exitCode": 0, "finishedAt": "2026-05-19T11:39:10Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:39:10+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:39:00Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://b8aa8dcb6c8da862c5ccc23562df2c515fbdd7138d198683c425661929d3a108", "exitCode": 0, "finishedAt": "2026-05-19T11:39:11Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:39:10+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:39:11Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "true", "description": "Whether to include important findings only", "name": "IMP_FINDINGS_ONLY", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Image digest to report findings for.", "name": "image-digest", "type": "string" }, { "default": "", "description": "Image URL.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "128m", "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "IMP_FINDINGS_ONLY", "value": "true" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-shell-check", "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n resolved_path=$(realpath -m \"$potential_path\")\n\n # ensure resolved path is still within SOURCE_CODE_DIR\n if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n ALL_TARGETS+=(\"$resolved_path\")\n else\n echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n exit 1\n fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n read -r quota period \u003c/sys/fs/cgroup/cpu.max\n if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n export SC_JOBS=$(((quota + period - 1) / period))\n echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n --mode=json\n --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n # predefined list of shellcheck important findings\n CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n CSGREP_OPTS+=(\n --event=\"$CSGREP_EVENT_FILTER\"\n )\nelse\n CSGREP_OPTS+=(\n --event=\"error|warning\"\n )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n echo \"Error occurred while running 'run-shellcheck.sh'\"\n note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n else\n mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "IMAGE_DIGEST", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n echo 'No image-url or image-digest param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n # Determine the media type based on the file extension\n if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n MEDIA_TYPE=\"application/json\"\n else\n MEDIA_TYPE=\"application/sarif+json\"\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n exit 1\n fi\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/commit_sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gsjcir", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537109186", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-7g9x2", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee/records/2c74d9ea-159e-4fd2-9865-faeda3d0b06a", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}", "results.tekton.dev/result": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone oci trusted artifacts", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8511962eff22b59cfd9661580edff4f0-5e7d3959d9530759-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:40:10Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRunUID": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-compo51f41fbdd6a4d2cd9bf9d1199bdc0f8c-clone-repository", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "uid": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee" } ], "resourceVersion": "87783", "uid": "2c74d9ea-159e-4fd2-9865-faeda3d0b06a" }, "spec": { "params": [ { "name": "url", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "revision", "value": "80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0.git" }, { "name": "ociArtifactExpiresAfter", "value": "6h" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "basic-auth", "secret": { "secretName": "pac-gitauth-gsjcir" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:40:20Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:40:20Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-compo51f41fbdd6a4d9608e5260405aec0e99a0f9a86afce28-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, "entryPoint": "git-clone-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "commit", "type": "string", "value": "80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "commit-timestamp", "type": "string", "value": "1779190796" }, { "name": "short-commit", "type": "string", "value": "80d5e38" }, { "name": "url", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a" } ], "spanContext": { "traceparent": "00-8511962eff22b59cfd9661580edff4f0-5e7d3959d9530759-01" }, "startTime": "2026-05-19T11:40:11Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "provenance": {}, "terminated": { "containerID": "cri-o://bc08cbffecf0ce44dba3f9347521bdf4ea168b1378ed98fdd28e1e345f10bdc7", "exitCode": 0, "finishedAt": "2026-05-19T11:40:18Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190796\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"80d5e38\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:17Z" }, "terminationReason": "Completed" }, { "container": "step-symlink-check", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "provenance": {}, "terminated": { "containerID": "cri-o://33412e791e5a578f597fa883fbc640da858bba54ae0396aadb13934260f8f992", "exitCode": 0, "finishedAt": "2026-05-19T11:40:18Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190796\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"80d5e38\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:18Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://e295cdf83e3e452b8cb3e18e34763bc1df7c32bbac41c8f0f0b0ac4f19cf338b", "exitCode": 0, "finishedAt": "2026-05-19T11:40:19Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a\",\"type\":1},{\"key\":\"commit\",\"value\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190796\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"80d5e38\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:18Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.", "params": [ { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "7", "description": "Length of short commit SHA", "name": "shortCommitLength", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n", "name": "submodulePaths", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "/tekton/home", "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n", "name": "userHome", "type": "string" }, { "default": "false", "description": "Log the commands that are executed during `git-clone`'s operation.", "name": "verbose", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" }, { "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" } ], "steps": [ { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "PARAM_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "PARAM_REVISION", "value": "80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "PARAM_REFSPEC" }, { "name": "PARAM_SUBMODULES", "value": "true" }, { "name": "PARAM_SUBMODULE_PATHS" }, { "name": "PARAM_DEPTH", "value": "1" }, { "name": "PARAM_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "PARAM_SSL_VERIFY", "value": "true" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "PARAM_VERBOSE", "value": "false" }, { "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "PARAM_USER_HOME", "value": "/tekton/home" }, { "name": "PARAM_FETCH_TAGS", "value": "false" }, { "name": "PARAM_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "PARAM_TARGET_BRANCH", "value": "main" }, { "name": "PARAM_MERGE_SOURCE_REPO_URL" }, { "name": "PARAM_MERGE_SOURCE_DEPTH" }, { "name": "WORKSPACE_SSH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_SSH_DIRECTORY_PATH" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND", "value": "true" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH", "value": "/workspace/basic-auth" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n # Compatibility with kubernetes.io/basic-auth secrets\n elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n else\n echo \"Unknown basic-auth workspace format\"\n exit 1\n fi\n chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n -url=\"${PARAM_URL}\" \\\n -revision=\"${PARAM_REVISION}\" \\\n -refspec=\"${PARAM_REFSPEC}\" \\\n -path=\"${CHECKOUT_DIR}\" \\\n -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n -submodules=\"${PARAM_SUBMODULES}\" \\\n -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n -depth=\"${PARAM_DEPTH}\" \\\n -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n # Determine if merging from a different repository or the same one\n if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n normalize_url() {\n echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n }\n\n NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n MERGE_REMOTE=\"origin\"\n else\n echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n echo \"Adding remote 'merge-source'...\"\n git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n MERGE_REMOTE=\"merge-source\"\n fi\n else\n echo \"Merging from the same repository (origin)\"\n MERGE_REMOTE=\"origin\"\n fi\n\n echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n else\n retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n fi\n\n echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n git config --global user.email \"tekton-git-clone@tekton.dev\"\n git config --global user.name \"Tekton Git Clone Task\"\n\n if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n echo \"--- Git Status ---\"\n git status\n echo \"------------------\"\n exit 1\n fi\n\n # Check if there are changes staged for commit\n if git diff --staged --quiet; then\n echo \"No diff was found, skipping merge...\" \u003e\u00262\n else\n echo \"Merge successful (no conflicts found), committing...\"\n if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n exit 1\n fi\n MERGED_SHA=$(git rev-parse HEAD)\n echo \"New HEAD after merge: ${MERGED_SHA}\"\n echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n fi\n\nelse\n echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n echo \"Fetching tags\"\n retry git fetch --tags\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "computeResources": {}, "env": [ { "name": "PARAM_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n while read -r symlink; do\n target=$(readlink -m \"$symlink\")\n if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n fi\n done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n return 1\n fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n echo \"Running symlink check\"\n check_symlinks\nfi\n", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0.git", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/commit_sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gsjcir", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537109186", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-7g9x2", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee/records/206c29d9-4888-4e53-97d3-66eb19e7ac71", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}", "results.tekton.dev/result": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8511962eff22b59cfd9661580edff4f0-a230ea5497812bff-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:43:08Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRunUID": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "tekton.dev/pipelineTask": "sast-shell-check", "tekton.dev/task": "sast-shell-check-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-compo51f41fbdd6a4d2cd9bf9d1199bdc0f8c-sast-shell-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "uid": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee" } ], "resourceVersion": "92343", "uid": "206c29d9-4888-4e53-97d3-66eb19e7ac71" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-shell-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:26Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:26Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-compo51f41fbdd6a4d6d2fb71ca6aef284762060c88d686fa0-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, "entryPoint": "sast-shell-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:43:24+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-8511962eff22b59cfd9661580edff4f0-a230ea5497812bff-01" }, "startTime": "2026-05-19T11:43:08Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://776d1339a6c608a0454090f8eb5704d677cc5c47a7b372232121f2a6399d635d", "exitCode": 0, "finishedAt": "2026-05-19T11:43:14Z", "reason": "Completed", "startedAt": "2026-05-19T11:43:14Z" }, "terminationReason": "Completed" }, { "container": "step-sast-shell-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-shell-check", "provenance": {}, "terminated": { "containerID": "cri-o://051eea6c39ef97d7d2dc2cae86f13209cd0dec49503bcbace200ddb427f24145", "exitCode": 0, "finishedAt": "2026-05-19T11:43:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:24+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:15Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://46fccb4c3f5ee7adfec44e298b86cad665d833161c55f7fea27ab211c080391c", "exitCode": 0, "finishedAt": "2026-05-19T11:43:25Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:24+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:24Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "true", "description": "Whether to include important findings only", "name": "IMP_FINDINGS_ONLY", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Image digest to report findings for.", "name": "image-digest", "type": "string" }, { "default": "", "description": "Image URL.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "128m", "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "IMP_FINDINGS_ONLY", "value": "true" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-shell-check", "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n resolved_path=$(realpath -m \"$potential_path\")\n\n # ensure resolved path is still within SOURCE_CODE_DIR\n if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n ALL_TARGETS+=(\"$resolved_path\")\n else\n echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n exit 1\n fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n read -r quota period \u003c/sys/fs/cgroup/cpu.max\n if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n export SC_JOBS=$(((quota + period - 1) / period))\n echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n --mode=json\n --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n # predefined list of shellcheck important findings\n CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n CSGREP_OPTS+=(\n --event=\"$CSGREP_EVENT_FILTER\"\n )\nelse\n CSGREP_OPTS+=(\n --event=\"error|warning\"\n )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n echo \"Error occurred while running 'run-shellcheck.sh'\"\n note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n else\n mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "IMAGE_DIGEST", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n echo 'No image-url or image-digest param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n # Determine the media type based on the file extension\n if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n MEDIA_TYPE=\"application/json\"\n else\n MEDIA_TYPE=\"application/sarif+json\"\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n exit 1\n fi\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/commit_sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-efgczi", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537079501", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-pull-request-p8f29", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de/records/90ccf621-320b-4182-9be7-1ee4f214b501", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone oci trusted artifacts", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-660eee8a28dcd3f4219f7b9a24544a26-181c719008fe35d3-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-ozak" }, "creationTimestamp": "2026-05-19T11:30:23Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRunUID": "f15699a7-890e-44ed-894d-e491f912d6de", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "529787a3d31011e383e7ca8b1425806842b93c02ed7a11d2dfaa720615f604" }, "name": "gl-multi-compo538c768f343f6ebf90f8f9860f456015-clone-repository", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "uid": "f15699a7-890e-44ed-894d-e491f912d6de" } ], "resourceVersion": "72269", "uid": "90ccf621-320b-4182-9be7-1ee4f214b501" }, "spec": { "params": [ { "name": "url", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "revision", "value": "df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc.git" }, { "name": "ociArtifactExpiresAfter", "value": "6h" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "basic-auth", "secret": { "secretName": "pac-gitauth-efgczi" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:30:31Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:30:31Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-compo538c768f343f68083c993b8bfeb74a7c497d73b90e478-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, "entryPoint": "git-clone-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "commit", "type": "string", "value": "df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "commit-timestamp", "type": "string", "value": "1779190208" }, { "name": "short-commit", "type": "string", "value": "df6fab6" }, { "name": "url", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b" } ], "spanContext": { "traceparent": "00-660eee8a28dcd3f4219f7b9a24544a26-181c719008fe35d3-01" }, "startTime": "2026-05-19T11:30:23Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "provenance": {}, "terminated": { "containerID": "cri-o://8d1f7c5670605de33dfb933ccaceeec819f5959a7d6216a2e461c4990d0c4be9", "exitCode": 0, "finishedAt": "2026-05-19T11:30:28Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190208\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"df6fab6\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:30:28Z" }, "terminationReason": "Completed" }, { "container": "step-symlink-check", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "provenance": {}, "terminated": { "containerID": "cri-o://e4668c428d1e8503506b2869bfb9e8585be1346192225148153691e38d760116", "exitCode": 0, "finishedAt": "2026-05-19T11:30:29Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190208\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"df6fab6\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:30:29Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://ff6f6ee3a9c50ad9fa198b95603cbcf4c37141c8e6b41d37d3374ff7d19fdfe0", "exitCode": 0, "finishedAt": "2026-05-19T11:30:30Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b\",\"type\":1},{\"key\":\"commit\",\"value\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190208\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"df6fab6\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:30:29Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.", "params": [ { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "7", "description": "Length of short commit SHA", "name": "shortCommitLength", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n", "name": "submodulePaths", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "/tekton/home", "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n", "name": "userHome", "type": "string" }, { "default": "false", "description": "Log the commands that are executed during `git-clone`'s operation.", "name": "verbose", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" }, { "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" } ], "steps": [ { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "PARAM_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "PARAM_REVISION", "value": "df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "PARAM_REFSPEC" }, { "name": "PARAM_SUBMODULES", "value": "true" }, { "name": "PARAM_SUBMODULE_PATHS" }, { "name": "PARAM_DEPTH", "value": "1" }, { "name": "PARAM_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "PARAM_SSL_VERIFY", "value": "true" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "PARAM_VERBOSE", "value": "false" }, { "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "PARAM_USER_HOME", "value": "/tekton/home" }, { "name": "PARAM_FETCH_TAGS", "value": "false" }, { "name": "PARAM_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "PARAM_TARGET_BRANCH", "value": "main" }, { "name": "PARAM_MERGE_SOURCE_REPO_URL" }, { "name": "PARAM_MERGE_SOURCE_DEPTH" }, { "name": "WORKSPACE_SSH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_SSH_DIRECTORY_PATH" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND", "value": "true" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH", "value": "/workspace/basic-auth" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n # Compatibility with kubernetes.io/basic-auth secrets\n elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n else\n echo \"Unknown basic-auth workspace format\"\n exit 1\n fi\n chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n -url=\"${PARAM_URL}\" \\\n -revision=\"${PARAM_REVISION}\" \\\n -refspec=\"${PARAM_REFSPEC}\" \\\n -path=\"${CHECKOUT_DIR}\" \\\n -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n -submodules=\"${PARAM_SUBMODULES}\" \\\n -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n -depth=\"${PARAM_DEPTH}\" \\\n -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n # Determine if merging from a different repository or the same one\n if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n normalize_url() {\n echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n }\n\n NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n MERGE_REMOTE=\"origin\"\n else\n echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n echo \"Adding remote 'merge-source'...\"\n git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n MERGE_REMOTE=\"merge-source\"\n fi\n else\n echo \"Merging from the same repository (origin)\"\n MERGE_REMOTE=\"origin\"\n fi\n\n echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n else\n retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n fi\n\n echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n git config --global user.email \"tekton-git-clone@tekton.dev\"\n git config --global user.name \"Tekton Git Clone Task\"\n\n if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n echo \"--- Git Status ---\"\n git status\n echo \"------------------\"\n exit 1\n fi\n\n # Check if there are changes staged for commit\n if git diff --staged --quiet; then\n echo \"No diff was found, skipping merge...\" \u003e\u00262\n else\n echo \"Merge successful (no conflicts found), committing...\"\n if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n exit 1\n fi\n MERGED_SHA=$(git rev-parse HEAD)\n echo \"New HEAD after merge: ${MERGED_SHA}\"\n echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n fi\n\nelse\n echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n echo \"Fetching tags\"\n retry git fetch --tags\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "computeResources": {}, "env": [ { "name": "PARAM_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n while read -r symlink; do\n target=$(readlink -m \"$symlink\")\n if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n fi\n done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n return 1\n fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n echo \"Running symlink check\"\n check_symlinks\nfi\n", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc.git", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/commit_sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-efgczi", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537079501", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-pull-request-p8f29", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de/records/d85c3c17-188f-41fb-bf08-f7feec276aa7", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-660eee8a28dcd3f4219f7b9a24544a26-d9c7c3706b857296-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-ozak" }, "creationTimestamp": "2026-05-19T11:34:12Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRunUID": "f15699a7-890e-44ed-894d-e491f912d6de", "tekton.dev/pipelineTask": "sast-shell-check", "tekton.dev/task": "sast-shell-check-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "529787a3d31011e383e7ca8b1425806842b93c02ed7a11d2dfaa720615f604" }, "name": "gl-multi-compo538c768f343f6ebf90f8f9860f456015-sast-shell-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "uid": "f15699a7-890e-44ed-894d-e491f912d6de" } ], "resourceVersion": "79525", "uid": "d85c3c17-188f-41fb-bf08-f7feec276aa7" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-shell-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:33Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:33Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-compo538c768f343f679cf739697e94cc1b0a9924781dec83d-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, "entryPoint": "sast-shell-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:34:31+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-660eee8a28dcd3f4219f7b9a24544a26-d9c7c3706b857296-01" }, "startTime": "2026-05-19T11:34:12Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://61dd72b66fd392462cb5f13a2dfcbc55f7c7f9d5e1538607294d23b16a6b5d02", "exitCode": 0, "finishedAt": "2026-05-19T11:34:18Z", "reason": "Completed", "startedAt": "2026-05-19T11:34:18Z" }, "terminationReason": "Completed" }, { "container": "step-sast-shell-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-shell-check", "provenance": {}, "terminated": { "containerID": "cri-o://f2b7201498e4116af590605330b8406d843bf8002875016db12ba1e9e1a6fa1b", "exitCode": 0, "finishedAt": "2026-05-19T11:34:32Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:31+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:19Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://451cde9d6739bfd5223a094dfbe97f7b2ad077bf55cab07048c64e10df561c6f", "exitCode": 0, "finishedAt": "2026-05-19T11:34:33Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:31+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:32Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "true", "description": "Whether to include important findings only", "name": "IMP_FINDINGS_ONLY", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Image digest to report findings for.", "name": "image-digest", "type": "string" }, { "default": "", "description": "Image URL.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "128m", "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "IMP_FINDINGS_ONLY", "value": "true" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-shell-check", "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n resolved_path=$(realpath -m \"$potential_path\")\n\n # ensure resolved path is still within SOURCE_CODE_DIR\n if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n ALL_TARGETS+=(\"$resolved_path\")\n else\n echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n exit 1\n fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n read -r quota period \u003c/sys/fs/cgroup/cpu.max\n if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n export SC_JOBS=$(((quota + period - 1) / period))\n echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n --mode=json\n --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n # predefined list of shellcheck important findings\n CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n CSGREP_OPTS+=(\n --event=\"$CSGREP_EVENT_FILTER\"\n )\nelse\n CSGREP_OPTS+=(\n --event=\"error|warning\"\n )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n echo \"Error occurred while running 'run-shellcheck.sh'\"\n note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n else\n mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "IMAGE_DIGEST", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n echo 'No image-url or image-digest param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n # Determine the media type based on the file extension\n if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n MEDIA_TYPE=\"application/json\"\n else\n MEDIA_TYPE=\"application/sarif+json\"\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n exit 1\n fi\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/commit_sha": "4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uilbnm", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537094607", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-s6q6q", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2/records/1dc78b73-a0ae-4d43-bf02-d29e740bef20", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db1dcf7d8e317492d30931804712ebee-9528cea77218ac4a-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:36:47Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRunUID": "a6fd6532-085f-49d9-8167-57532fd6ecd2", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-compon4a2a2be585514454a0d63daa59818ab1-build-container", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "uid": "a6fd6532-085f-49d9-8167-57532fd6ecd2" } ], "resourceVersion": "84670", "uid": "1dc78b73-a0ae-4d43-bf02-d29e740bef20" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" }, { "name": "COMMIT_SHA", "value": "4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:38:43Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:38:43Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-compon4a2a2be585510460fd9468a9dcfd46b4f758d757df88-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, "entryPoint": "buildah-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min" } }, "results": [ { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "SBOM_BLOB_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:a9e5603ead05f328e0d15093ed4d206d377283fef9cce4e5b092a5dc3ea1ccc4" } ], "spanContext": { "traceparent": "00-db1dcf7d8e317492d30931804712ebee-9528cea77218ac4a-01" }, "startTime": "2026-05-19T11:36:47Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://41eb9fe22fb84ffd3be64324eb73a01ed373efa0e6f87f997470075dbfc49dc4", "exitCode": 0, "finishedAt": "2026-05-19T11:36:53Z", "reason": "Completed", "startedAt": "2026-05-19T11:36:53Z" }, "terminationReason": "Completed" }, { "container": "step-build", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://d1e8bf71a6441001a4f3f596220d4927d9018c374aeafd1b2d92cbc06b35c529", "exitCode": 0, "finishedAt": "2026-05-19T11:37:08Z", "reason": "Completed", "startedAt": "2026-05-19T11:36:54Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://a4b054d6a8426ffda84e40e58af3ffe16ab93af072db1e043493dd1574b6e9dc", "exitCode": 0, "finishedAt": "2026-05-19T11:37:40Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:37:08Z" }, "terminationReason": "Completed" }, { "container": "step-sbom-syft-generate", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "provenance": {}, "terminated": { "containerID": "cri-o://d0871dcb62d2ba018b28185e03c510f5f91d6c5c4a800c6a69e8befec5a5dde6", "exitCode": 0, "finishedAt": "2026-05-19T11:37:57Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:37:40Z" }, "terminationReason": "Completed" }, { "container": "step-prepare-sboms", "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "provenance": {}, "terminated": { "containerID": "cri-o://91592f0e62284ce7b193d58601e63831f2b54291b964a435e5cb73e451840da1", "exitCode": 0, "finishedAt": "2026-05-19T11:38:17Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:37:57Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://510df7b154fe1e0837017de1fdcfb95f934c3d4526507448ef4f386c32fd7e71", "exitCode": 0, "finishedAt": "2026-05-19T11:38:42Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808@sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:a9e5603ead05f328e0d15093ed4d206d377283fef9cce4e5b092a5dc3ea1ccc4\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:38:18Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "ACTIVATION_KEY", "value": "activation-key" }, { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "ADD_CAPABILITIES" }, { "name": "ANNOTATIONS_FILE" }, { "name": "BUILD_ARGS_FILE" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXT", "value": "." }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "ENTITLEMENT_SECRET", "value": "etc-pki-entitlement" }, { "name": "HERMETIC", "value": "false" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SKIP_INJECTIONS", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "SQUASH", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "TARGET_STAGE" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:7596a2aa72cd29a6d579a6cd3965c1e8e9f900305e32819403cd7f9b67a3d929=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "--build-args", "--env", "--labels", "--annotations" ], "computeResources": { "limits": { "cpu": "500m", "memory": "1Gi" }, "requests": { "cpu": "500m", "memory": "1Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n fi\n fi\n}\n\nfunction unset_proxy {\n echo \"[$(date --utc -Ins)] Unsetting proxy\"\n unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n # path is valid, do nothing\n ;;\n*)\n echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n echo \"Source path: $source_dir_path\" \u003e\u00262\n echo \"Resolved path: $context_dir_path\" \u003e\u00262\n exit 1\n ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n # Instrumented builds (SAST) use this custom dockerfile step as their base\n dockerfile_path=\"$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n while IFS= read -r line || [[ -n \"$line\" ]]; do\n # Skip empty lines and comments\n if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n ANNOTATIONS+=(\"--annotation\" \"$line\")\n fi\n done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --build-args)\n shift\n # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n build_args+=(\"$1\")\n shift\n done\n ;;\n --env)\n shift\n # Collect env entries of the form KEY=value\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n env_vars+=(\"$1\")\n shift\n done\n ;;\n --labels)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n LABELS+=(\"--label\" \"$1\")\n shift\n done\n ;;\n --annotations)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ANNOTATIONS+=(\"--annotation\" \"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--pull=never\")\n UNSHARE_ARGS+=(\"--net\")\n buildah_retries=3\n\n set_proxy\n\n for image in $BASE_IMAGES; do\n if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n echo \"Failed to pull base image ${image}\"\n exit 1\n fi\n done\n\n unset_proxy\n\n echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n BUILDAH_ARGS+=(\"--cap-add=all\")\n BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n fi\n if [ -n \"$BUILD_TIMESTAMP\" ]; then\n echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n exit 1\n fi\n # but do set it so that we get all the labels/annotations associated with it\n BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n # Identify the current arch to filter the prefetched content\n PREFETCH_ARCH=\"$(uname -m)\"\n echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n echo \"Prefetched content will be made available\"\n\n cp -r \"/var/workdir/cachi2\" /tmp/\n chmod -R go+rwX /tmp/cachi2\n\n # In case RPMs were prefetched and this is a multi-arch build,\n # clean up the packages that do not match the architecture being built\n RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n echo \"Removing prefetched RPMs from non-matching architectures\"\n PREFETCH_ARCH=\"$(uname -m)\"\n for path in \"$RPM_PREFETCH_DIR\"/*; do\n if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n echo \"Removing: $path\"\n rm -rf \"$path\"\n else\n echo \"Keeping: $path\"\n fi\n done\n fi\n\n VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n sed -E -i \\\n -e 'H;1h;$!d;x' \\\n -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n @igM' \\\n \"$dockerfile_copy\"\n\n prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n mkdir -p \"$YUM_REPOS_D_FETCHED\"\n if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n fi\n fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n \"--label\" \"architecture=$(uname -m)\"\n \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n FINAL_BASE_IMAGE=$(\n # Get the base image of the final stage\n # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n # Run the find_root_stage() function on the final stage\n # If the final stage is scratch or oci-archive, return empty\n jq -r '.Stages as $all_stages |\n def find_root_stage($stage):\n if $stage.From.Stage then\n find_root_stage($all_stages[$stage.From.Stage.Index])\n else\n $stage\n end;\n\n find_root_stage(.Stages[-1]) |\n if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n empty\n else\n .BaseName\n end' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n )\n if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n set_proxy\n buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n unset_proxy\n buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n if [[ \"$label\" != \"--label\" ]]; then\n label_pairs+=(\"$label\")\n fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n echo \"\" \u003e\u003e\"$dockerfile_copy\"\n # Always write labels.json to the new standard location\n echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n # Conditionally write to the old location for backward compatibility\n if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n cp \"$containerignore\" \"$ignorefile_copy\"\n {\n echo \"\"\n echo \"!/labels.json\"\n echo \"!/content-sets.json\"\n } \u003e\u003e\"$ignorefile_copy\"\n BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n mkdir -p /shared/rhsm/etc/pki/entitlement\n mkdir -p /shared/rhsm/etc/pki/consumer\n\n VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n echo \"Adding activation key to the build\"\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n echo \"Pre-registering with subscription manager.\"\n export RETRY_MAX_TRIES=6\n if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n echo \"Subscription-manager register failed\"\n exit 1\n fi\n unset RETRY_MAX_TRIES\n trap 'subscription-manager unregister || true' EXIT\n\n # copy generated certificates to /shared volume\n cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n exit 1\n fi\n # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n # (we set the workdir using 'unshare -w')\n context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n # Instrumented builds (SAST) use this step as their base and add some other tools.\n while read -r volume_mount; do\n VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n while read -r filename; do\n echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n buildah build\n \"${VOLUME_MOUNTS[@]}\"\n \"${BUILDAH_ARGS[@]}\"\n \"${LABELS[@]}\"\n \"${ANNOTATIONS[@]}\"\n --tls-verify=\"$TLSVERIFY\" --no-cache\n --ulimit nofile=4096:4096\n --http-proxy=false\n -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n # Get the image pullspec and filter out a tag if it is not set\n # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n # if buildah did not use that particular image during build because it was skipped\n if [ -n \"$base_image_digest\" ]; then\n echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "gl-multi-compon4a2a2be585514454a0d63daa59818ab1-build-container" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"; then\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n echo -n \"${IMAGE}@\"\n cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e/shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "256m", "memory": "512Mi" }, "requests": { "cpu": "256m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n syft_sbom_type=cyclonedx-json@1.5\n ;;\nspdx)\n syft_sbom_type=spdx-json@2.3\n ;;\n*)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ADDITIONAL_BASE_IMAGES+=(\"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/var/workdir/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "emptyDir": {}, "name": "shared" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/commit_sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gsjcir", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537109186", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-7g9x2", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee/records/ba16fe7f-6414-4adc-8310-ace8fb349fed", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}", "results.tekton.dev/result": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8511962eff22b59cfd9661580edff4f0-c7093f9bb74152cd-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:41:00Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRunUID": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-compon51f41fbdd6a4d2cd9bf9d1199bdc0f8c-build-container", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "uid": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee" } ], "resourceVersion": "91215", "uid": "ba16fe7f-6414-4adc-8310-ace8fb349fed" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" }, { "name": "COMMIT_SHA", "value": "80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:42:57Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:42:57Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-compon51f41fbdd6a49eeb06fdd23d2e56e89b14c57a4e8ac7-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, "entryPoint": "buildah-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min" } }, "results": [ { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "SBOM_BLOB_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:554829d4c9eac0c480c34b999ca9602fb9793ad0a93c756313743b0f72d5781b" } ], "spanContext": { "traceparent": "00-8511962eff22b59cfd9661580edff4f0-c7093f9bb74152cd-01" }, "startTime": "2026-05-19T11:41:00Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://1075a9dbbd733e702f2b3fdfdc114917b305372bb74b9b07de6d30832a316c64", "exitCode": 0, "finishedAt": "2026-05-19T11:41:07Z", "reason": "Completed", "startedAt": "2026-05-19T11:41:07Z" }, "terminationReason": "Completed" }, { "container": "step-build", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://c69721e5e1a9f67d7d63b0dcbf35833cb1269477fcc22dbaa90e6314b9e3ac0a", "exitCode": 0, "finishedAt": "2026-05-19T11:41:21Z", "reason": "Completed", "startedAt": "2026-05-19T11:41:08Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://1c28cb265d4875f9e7d9fa9b050995e7e83a3390ac1f1a56abece3aa93ddb147", "exitCode": 0, "finishedAt": "2026-05-19T11:41:54Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:22Z" }, "terminationReason": "Completed" }, { "container": "step-sbom-syft-generate", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "provenance": {}, "terminated": { "containerID": "cri-o://cbdee8cafd1e403caa54dd9b722f7a6c749ee8cc59ed7586632d9a769af2ebb2", "exitCode": 0, "finishedAt": "2026-05-19T11:42:10Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:54Z" }, "terminationReason": "Completed" }, { "container": "step-prepare-sboms", "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "provenance": {}, "terminated": { "containerID": "cri-o://f35006952e02a6510d1c1a850cb6e629ce0fc7e97a84e7e65fdd1b5ea94b3f0c", "exitCode": 0, "finishedAt": "2026-05-19T11:42:31Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:42:10Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://5e5c269a68df415e3cb5b9fb9e9e4582db24c23b6a35dd53b7879cb4ec21ae40", "exitCode": 0, "finishedAt": "2026-05-19T11:42:56Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0@sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:554829d4c9eac0c480c34b999ca9602fb9793ad0a93c756313743b0f72d5781b\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:42:31Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "ACTIVATION_KEY", "value": "activation-key" }, { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "ADD_CAPABILITIES" }, { "name": "ANNOTATIONS_FILE" }, { "name": "BUILD_ARGS_FILE" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXT", "value": "." }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "ENTITLEMENT_SECRET", "value": "etc-pki-entitlement" }, { "name": "HERMETIC", "value": "false" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SKIP_INJECTIONS", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "SQUASH", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "TARGET_STAGE" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:ae2a56e9ffc1ced87a76ca7c1e7d2ef8ab63b8d3c7b644183daf93b2c359665a=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "--build-args", "--env", "--labels", "--annotations" ], "computeResources": { "limits": { "cpu": "500m", "memory": "1Gi" }, "requests": { "cpu": "500m", "memory": "1Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n fi\n fi\n}\n\nfunction unset_proxy {\n echo \"[$(date --utc -Ins)] Unsetting proxy\"\n unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n # path is valid, do nothing\n ;;\n*)\n echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n echo \"Source path: $source_dir_path\" \u003e\u00262\n echo \"Resolved path: $context_dir_path\" \u003e\u00262\n exit 1\n ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n # Instrumented builds (SAST) use this custom dockerfile step as their base\n dockerfile_path=\"$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n while IFS= read -r line || [[ -n \"$line\" ]]; do\n # Skip empty lines and comments\n if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n ANNOTATIONS+=(\"--annotation\" \"$line\")\n fi\n done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --build-args)\n shift\n # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n build_args+=(\"$1\")\n shift\n done\n ;;\n --env)\n shift\n # Collect env entries of the form KEY=value\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n env_vars+=(\"$1\")\n shift\n done\n ;;\n --labels)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n LABELS+=(\"--label\" \"$1\")\n shift\n done\n ;;\n --annotations)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ANNOTATIONS+=(\"--annotation\" \"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--pull=never\")\n UNSHARE_ARGS+=(\"--net\")\n buildah_retries=3\n\n set_proxy\n\n for image in $BASE_IMAGES; do\n if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n echo \"Failed to pull base image ${image}\"\n exit 1\n fi\n done\n\n unset_proxy\n\n echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n BUILDAH_ARGS+=(\"--cap-add=all\")\n BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n fi\n if [ -n \"$BUILD_TIMESTAMP\" ]; then\n echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n exit 1\n fi\n # but do set it so that we get all the labels/annotations associated with it\n BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n # Identify the current arch to filter the prefetched content\n PREFETCH_ARCH=\"$(uname -m)\"\n echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n echo \"Prefetched content will be made available\"\n\n cp -r \"/var/workdir/cachi2\" /tmp/\n chmod -R go+rwX /tmp/cachi2\n\n # In case RPMs were prefetched and this is a multi-arch build,\n # clean up the packages that do not match the architecture being built\n RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n echo \"Removing prefetched RPMs from non-matching architectures\"\n PREFETCH_ARCH=\"$(uname -m)\"\n for path in \"$RPM_PREFETCH_DIR\"/*; do\n if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n echo \"Removing: $path\"\n rm -rf \"$path\"\n else\n echo \"Keeping: $path\"\n fi\n done\n fi\n\n VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n sed -E -i \\\n -e 'H;1h;$!d;x' \\\n -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n @igM' \\\n \"$dockerfile_copy\"\n\n prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n mkdir -p \"$YUM_REPOS_D_FETCHED\"\n if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n fi\n fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n \"--label\" \"architecture=$(uname -m)\"\n \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n FINAL_BASE_IMAGE=$(\n # Get the base image of the final stage\n # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n # Run the find_root_stage() function on the final stage\n # If the final stage is scratch or oci-archive, return empty\n jq -r '.Stages as $all_stages |\n def find_root_stage($stage):\n if $stage.From.Stage then\n find_root_stage($all_stages[$stage.From.Stage.Index])\n else\n $stage\n end;\n\n find_root_stage(.Stages[-1]) |\n if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n empty\n else\n .BaseName\n end' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n )\n if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n set_proxy\n buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n unset_proxy\n buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n if [[ \"$label\" != \"--label\" ]]; then\n label_pairs+=(\"$label\")\n fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n echo \"\" \u003e\u003e\"$dockerfile_copy\"\n # Always write labels.json to the new standard location\n echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n # Conditionally write to the old location for backward compatibility\n if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n cp \"$containerignore\" \"$ignorefile_copy\"\n {\n echo \"\"\n echo \"!/labels.json\"\n echo \"!/content-sets.json\"\n } \u003e\u003e\"$ignorefile_copy\"\n BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n mkdir -p /shared/rhsm/etc/pki/entitlement\n mkdir -p /shared/rhsm/etc/pki/consumer\n\n VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n echo \"Adding activation key to the build\"\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n echo \"Pre-registering with subscription manager.\"\n export RETRY_MAX_TRIES=6\n if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n echo \"Subscription-manager register failed\"\n exit 1\n fi\n unset RETRY_MAX_TRIES\n trap 'subscription-manager unregister || true' EXIT\n\n # copy generated certificates to /shared volume\n cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n exit 1\n fi\n # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n # (we set the workdir using 'unshare -w')\n context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n # Instrumented builds (SAST) use this step as their base and add some other tools.\n while read -r volume_mount; do\n VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n while read -r filename; do\n echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n buildah build\n \"${VOLUME_MOUNTS[@]}\"\n \"${BUILDAH_ARGS[@]}\"\n \"${LABELS[@]}\"\n \"${ANNOTATIONS[@]}\"\n --tls-verify=\"$TLSVERIFY\" --no-cache\n --ulimit nofile=4096:4096\n --http-proxy=false\n -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n # Get the image pullspec and filter out a tag if it is not set\n # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n # if buildah did not use that particular image during build because it was skipped\n if [ -n \"$base_image_digest\" ]; then\n echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "gl-multi-compon51f41fbdd6a4d2cd9bf9d1199bdc0f8c-build-container" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"; then\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n echo -n \"${IMAGE}@\"\n cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e/shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "256m", "memory": "512Mi" }, "requests": { "cpu": "256m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n syft_sbom_type=cyclonedx-json@1.5\n ;;\nspdx)\n syft_sbom_type=spdx-json@2.3\n ;;\n*)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ADDITIONAL_BASE_IMAGES+=(\"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/var/workdir/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "emptyDir": {}, "name": "shared" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/commit_sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-efgczi", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537079501", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-pull-request-p8f29", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de/records/99de4ebd-e524-4b67-b089-bafc19a5e0fb", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-660eee8a28dcd3f4219f7b9a24544a26-227bbb0f9b0e8e95-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-ozak" }, "creationTimestamp": "2026-05-19T11:31:14Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRunUID": "f15699a7-890e-44ed-894d-e491f912d6de", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "529787a3d31011e383e7ca8b1425806842b93c02ed7a11d2dfaa720615f604" }, "name": "gl-multi-compon538c768f343f6ebf90f8f9860f456015-build-container", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "uid": "f15699a7-890e-44ed-894d-e491f912d6de" } ], "resourceVersion": "77759", "uid": "99de4ebd-e524-4b67-b089-bafc19a5e0fb" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" }, { "name": "COMMIT_SHA", "value": "df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:01Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:01Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-compon538c768f343f7ecc8e713befc1866e1344f1fa4d8a78-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, "entryPoint": "buildah-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min" } }, "results": [ { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "SBOM_BLOB_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:2a76a3507b02788feb0f9e3d6c4c728dd09a03e096f2549cd3c741fcdabbe68b" } ], "spanContext": { "traceparent": "00-660eee8a28dcd3f4219f7b9a24544a26-227bbb0f9b0e8e95-01" }, "startTime": "2026-05-19T11:31:14Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://f80954d1a70e8d72e2dbcc11d2883ec2b26eb9a7a50b1cf4df76e02cf5b9b77d", "exitCode": 0, "finishedAt": "2026-05-19T11:31:20Z", "reason": "Completed", "startedAt": "2026-05-19T11:31:20Z" }, "terminationReason": "Completed" }, { "container": "step-build", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://e0f373bd461d8980605d3259fda2a96f52cbd89154b6ef4a88bea522ec9876fd", "exitCode": 0, "finishedAt": "2026-05-19T11:31:39Z", "reason": "Completed", "startedAt": "2026-05-19T11:31:21Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://0a69a86f05a49931ad953408e086b79c618e809d7e6b4e4966229318a82dce45", "exitCode": 0, "finishedAt": "2026-05-19T11:33:01Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:31:39Z" }, "terminationReason": "Completed" }, { "container": "step-sbom-syft-generate", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "provenance": {}, "terminated": { "containerID": "cri-o://b82da659fc0b33648b9b30681f766f4819d5104701b79ccc643ece05b5f8f094", "exitCode": 0, "finishedAt": "2026-05-19T11:33:18Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:33:01Z" }, "terminationReason": "Completed" }, { "container": "step-prepare-sboms", "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "provenance": {}, "terminated": { "containerID": "cri-o://0a07868e01875642ccf78dc07b1fb4e8325f82dd78c5fa5b9a917ceb6d9110c3", "exitCode": 0, "finishedAt": "2026-05-19T11:33:35Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:33:18Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://e8c9a087f80872f93131953b8f9d6c61be5362077841cf5bdb31a428de4cf04e", "exitCode": 0, "finishedAt": "2026-05-19T11:34:00Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc@sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:2a76a3507b02788feb0f9e3d6c4c728dd09a03e096f2549cd3c741fcdabbe68b\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:33:35Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "ACTIVATION_KEY", "value": "activation-key" }, { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "ADD_CAPABILITIES" }, { "name": "ANNOTATIONS_FILE" }, { "name": "BUILD_ARGS_FILE" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXT", "value": "." }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "ENTITLEMENT_SECRET", "value": "etc-pki-entitlement" }, { "name": "HERMETIC", "value": "false" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SKIP_INJECTIONS", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "SQUASH", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "TARGET_STAGE" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:242f40dec744e201d4e4e5172df1782d41a0a39808b991c3464a509d28e0fc5b=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "--build-args", "--env", "--labels", "--annotations" ], "computeResources": { "limits": { "cpu": "500m", "memory": "1Gi" }, "requests": { "cpu": "500m", "memory": "1Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n fi\n fi\n}\n\nfunction unset_proxy {\n echo \"[$(date --utc -Ins)] Unsetting proxy\"\n unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n # path is valid, do nothing\n ;;\n*)\n echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n echo \"Source path: $source_dir_path\" \u003e\u00262\n echo \"Resolved path: $context_dir_path\" \u003e\u00262\n exit 1\n ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n # Instrumented builds (SAST) use this custom dockerfile step as their base\n dockerfile_path=\"$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n while IFS= read -r line || [[ -n \"$line\" ]]; do\n # Skip empty lines and comments\n if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n ANNOTATIONS+=(\"--annotation\" \"$line\")\n fi\n done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --build-args)\n shift\n # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n build_args+=(\"$1\")\n shift\n done\n ;;\n --env)\n shift\n # Collect env entries of the form KEY=value\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n env_vars+=(\"$1\")\n shift\n done\n ;;\n --labels)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n LABELS+=(\"--label\" \"$1\")\n shift\n done\n ;;\n --annotations)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ANNOTATIONS+=(\"--annotation\" \"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--pull=never\")\n UNSHARE_ARGS+=(\"--net\")\n buildah_retries=3\n\n set_proxy\n\n for image in $BASE_IMAGES; do\n if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n echo \"Failed to pull base image ${image}\"\n exit 1\n fi\n done\n\n unset_proxy\n\n echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n BUILDAH_ARGS+=(\"--cap-add=all\")\n BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n fi\n if [ -n \"$BUILD_TIMESTAMP\" ]; then\n echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n exit 1\n fi\n # but do set it so that we get all the labels/annotations associated with it\n BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n # Identify the current arch to filter the prefetched content\n PREFETCH_ARCH=\"$(uname -m)\"\n echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n echo \"Prefetched content will be made available\"\n\n cp -r \"/var/workdir/cachi2\" /tmp/\n chmod -R go+rwX /tmp/cachi2\n\n # In case RPMs were prefetched and this is a multi-arch build,\n # clean up the packages that do not match the architecture being built\n RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n echo \"Removing prefetched RPMs from non-matching architectures\"\n PREFETCH_ARCH=\"$(uname -m)\"\n for path in \"$RPM_PREFETCH_DIR\"/*; do\n if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n echo \"Removing: $path\"\n rm -rf \"$path\"\n else\n echo \"Keeping: $path\"\n fi\n done\n fi\n\n VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n sed -E -i \\\n -e 'H;1h;$!d;x' \\\n -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n @igM' \\\n \"$dockerfile_copy\"\n\n prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n mkdir -p \"$YUM_REPOS_D_FETCHED\"\n if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n fi\n fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n \"--label\" \"architecture=$(uname -m)\"\n \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n FINAL_BASE_IMAGE=$(\n # Get the base image of the final stage\n # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n # Run the find_root_stage() function on the final stage\n # If the final stage is scratch or oci-archive, return empty\n jq -r '.Stages as $all_stages |\n def find_root_stage($stage):\n if $stage.From.Stage then\n find_root_stage($all_stages[$stage.From.Stage.Index])\n else\n $stage\n end;\n\n find_root_stage(.Stages[-1]) |\n if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n empty\n else\n .BaseName\n end' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n )\n if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n set_proxy\n buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n unset_proxy\n buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n if [[ \"$label\" != \"--label\" ]]; then\n label_pairs+=(\"$label\")\n fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n echo \"\" \u003e\u003e\"$dockerfile_copy\"\n # Always write labels.json to the new standard location\n echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n # Conditionally write to the old location for backward compatibility\n if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n cp \"$containerignore\" \"$ignorefile_copy\"\n {\n echo \"\"\n echo \"!/labels.json\"\n echo \"!/content-sets.json\"\n } \u003e\u003e\"$ignorefile_copy\"\n BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n mkdir -p /shared/rhsm/etc/pki/entitlement\n mkdir -p /shared/rhsm/etc/pki/consumer\n\n VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n echo \"Adding activation key to the build\"\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n echo \"Pre-registering with subscription manager.\"\n export RETRY_MAX_TRIES=6\n if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n echo \"Subscription-manager register failed\"\n exit 1\n fi\n unset RETRY_MAX_TRIES\n trap 'subscription-manager unregister || true' EXIT\n\n # copy generated certificates to /shared volume\n cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n exit 1\n fi\n # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n # (we set the workdir using 'unshare -w')\n context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n # Instrumented builds (SAST) use this step as their base and add some other tools.\n while read -r volume_mount; do\n VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n while read -r filename; do\n echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n buildah build\n \"${VOLUME_MOUNTS[@]}\"\n \"${BUILDAH_ARGS[@]}\"\n \"${LABELS[@]}\"\n \"${ANNOTATIONS[@]}\"\n --tls-verify=\"$TLSVERIFY\" --no-cache\n --ulimit nofile=4096:4096\n --http-proxy=false\n -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n # Get the image pullspec and filter out a tag if it is not set\n # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n # if buildah did not use that particular image during build because it was skipped\n if [ -n \"$base_image_digest\" ]; then\n echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "gl-multi-compon538c768f343f6ebf90f8f9860f456015-build-container" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"; then\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n echo -n \"${IMAGE}@\"\n cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e/shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "256m", "memory": "512Mi" }, "requests": { "cpu": "256m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n syft_sbom_type=cyclonedx-json@1.5\n ;;\nspdx)\n syft_sbom_type=spdx-json@2.3\n ;;\n*)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ADDITIONAL_BASE_IMAGES+=(\"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/var/workdir/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "emptyDir": {}, "name": "shared" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/commit_sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-efgczi", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537079501", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-pull-request-p8f29", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de/records/09a1e4bb-2b9f-482b-ae81-ff9de653ea32", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "virus, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-660eee8a28dcd3f4219f7b9a24544a26-1d4a7bad19085070-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-ozak" }, "creationTimestamp": "2026-05-19T11:34:12Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRunUID": "f15699a7-890e-44ed-894d-e491f912d6de", "tekton.dev/pipelineTask": "clamav-scan", "tekton.dev/task": "clamav-scan-min", "test.appstudio.openshift.io/pr-group-sha": "529787a3d31011e383e7ca8b1425806842b93c02ed7a11d2dfaa720615f604" }, "name": "gl-multi-component-538c768f343f6ebf90f8f9860f456015-clamav-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "uid": "f15699a7-890e-44ed-894d-e491f912d6de" } ], "resourceVersion": "80487", "uid": "09a1e4bb-2b9f-482b-ae81-ff9de653ea32" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:35:25Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:35:25Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-538c768f2f03cbe02d8a3e5330b9aaa9395c2ded-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, "entryPoint": "clamav-scan-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\", \"digests\": [\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779190521\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n" } ], "spanContext": { "traceparent": "00-660eee8a28dcd3f4219f7b9a24544a26-1d4a7bad19085070-01" }, "startTime": "2026-05-19T11:34:12Z", "steps": [ { "container": "step-extract-and-scan-image", "imageID": "quay.io/konflux-ci/clamav-db@sha256:2ee72ac5cda517125824c8139ade1dbf21ee93377e78ece9ef24ec0c55518fe9", "name": "extract-and-scan-image", "provenance": {}, "terminated": { "containerID": "cri-o://902d227d3c2a490b3afd5fa89a51f4688b0c05344d76eeddaaecc8198f52f76b", "exitCode": 0, "finishedAt": "2026-05-19T11:35:22Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\\\", \\\"digests\\\": [\\\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190521\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:16Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://3ee9291263a5d1e95f50ff91e47359781593e353d916fdada35dbe476bcc3f6c", "exitCode": 0, "finishedAt": "2026-05-19T11:35:24Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\\\", \\\"digests\\\": [\\\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190521\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:35:22Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image arch.", "name": "image-arch", "type": "string" }, { "default": "", "description": "unused", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "8", "description": "Maximum number of threads clamd runs.", "name": "clamd-max-threads", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-upload", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "512m", "memory": "3Gi" }, "requests": { "cpu": "512m", "memory": "3Gi" } }, "env": [ { "name": "HOME", "value": "/work" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "IMAGE_DIGEST", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "IMAGE_ARCH" }, { "name": "MAX_THREADS", "value": "8" } ], "image": "quay.io/konflux-ci/clamav-db:latest", "name": "extract-and-scan-image", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n mkdir -p ~/.docker\n echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n# $1: destination - path to the content to scan\n# $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n# $3: digest - digest to add to digests_processed array\n# $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n local destination=\"$1\"\n local suffix=\"$2\"\n local digest=\"$3\"\n local scan_message=\"${4:-Scanning content}\"\n\n db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n echo \"$scan_message. This operation may take a while.\"\n clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n digests_processed+=(\"\\\"$digest\\\"\")\n\n if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n # OPA/EC requires structured data input, add clamAV log into json\n jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o json \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o appstudio \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n\n if [ -n \"$raw_manifest\" ]; then\n media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n # Determine if this is an OCI artifact (not a container image)\n # OCI artifacts typically have:\n # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n # - An explicit artifactType field that is not a container image type\n is_oci_artifact=false\n\n # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n is_oci_artifact=true\n fi\n\n # Check if artifactType is set and is not a container image type\n if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n is_oci_artifact=true\n fi\n\n if [ \"$is_oci_artifact\" = true ]; then\n # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n # This looks like a container image manifest, but get_image_manifests failed\n echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n else\n # Likely an OCI artifact with non-standard media type\n echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n fi\n else\n echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n echo \"Detected container image. Processing image manifests.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n # Proceed only if a specific arch is provided.\n # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n if [ -n \"$IMAGE_ARCH\" ]; then\n arch=\"${IMAGE_ARCH#*/}\"\n if [ \"${arch}\" = \"x86_64\" ]; then\n arch=\"amd64\"\n fi\n\n # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n arch=\"amd64\"\n ;;\n esac\n\n image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n fi\n\n while read -r arch arch_sha; do\n destination=\"content-${arch}\"\n mkdir -p \"$destination\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n exit 0\n fi\n\n # Scan and process container image for this architecture\n scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n {\n \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n \"namespace\" : $item.namespace,\n \"successes\" : (.successes + $item.successes),\n \"failures\" : (.failures + $item.failures),\n \"warnings\" : (.warnings + $item.warnings),\n \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_UPLOAD", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "IMAGE_DIGEST", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n echo \"Upload skipped by parameter.\"\n exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n MEDIA_TYPE=text/vnd.clamav\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n MEDIA_TYPE=application/vnd.konflux.test_output+json\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n echo \"No files found. Skipping upload.\"\n exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n", "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" } ], "volumes": [ { "emptyDir": {}, "name": "dbfolder" }, { "emptyDir": {}, "name": "work" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/commit_sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gsjcir", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537109186", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-7g9x2", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee/records/fc9e01a0-0919-4024-b44b-df4d4fe78545", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}", "results.tekton.dev/result": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "virus, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8511962eff22b59cfd9661580edff4f0-74b3e6ee8340263a-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:43:08Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRunUID": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "tekton.dev/pipelineTask": "clamav-scan", "tekton.dev/task": "clamav-scan-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2-clamav-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "uid": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee" } ], "resourceVersion": "93925", "uid": "fc9e01a0-0919-4024-b44b-df4d4fe78545" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:14Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:14Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozd05b5ee376ee3efb89339a5a5ab27988-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, "entryPoint": "clamav-scan-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\", \"digests\": [\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779191051\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n" } ], "spanContext": { "traceparent": "00-8511962eff22b59cfd9661580edff4f0-74b3e6ee8340263a-01" }, "startTime": "2026-05-19T11:43:08Z", "steps": [ { "container": "step-extract-and-scan-image", "imageID": "quay.io/konflux-ci/clamav-db@sha256:2ee72ac5cda517125824c8139ade1dbf21ee93377e78ece9ef24ec0c55518fe9", "name": "extract-and-scan-image", "provenance": {}, "terminated": { "containerID": "cri-o://62c503e8924d9f446ab8fe664fb20b22506011d73d26434eccb0962ec05ef40d", "exitCode": 0, "finishedAt": "2026-05-19T11:44:11Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\\\", \\\"digests\\\": [\\\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779191051\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:13Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://6ff1f1a507b27c74c2784abd0dbe7408cef93539cb9a881ec03d66c54dd80769", "exitCode": 0, "finishedAt": "2026-05-19T11:44:14Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\\\", \\\"digests\\\": [\\\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779191051\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:11Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image arch.", "name": "image-arch", "type": "string" }, { "default": "", "description": "unused", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "8", "description": "Maximum number of threads clamd runs.", "name": "clamd-max-threads", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-upload", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "512m", "memory": "3Gi" }, "requests": { "cpu": "512m", "memory": "3Gi" } }, "env": [ { "name": "HOME", "value": "/work" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "IMAGE_DIGEST", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "IMAGE_ARCH" }, { "name": "MAX_THREADS", "value": "8" } ], "image": "quay.io/konflux-ci/clamav-db:latest", "name": "extract-and-scan-image", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n mkdir -p ~/.docker\n echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n# $1: destination - path to the content to scan\n# $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n# $3: digest - digest to add to digests_processed array\n# $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n local destination=\"$1\"\n local suffix=\"$2\"\n local digest=\"$3\"\n local scan_message=\"${4:-Scanning content}\"\n\n db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n echo \"$scan_message. This operation may take a while.\"\n clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n digests_processed+=(\"\\\"$digest\\\"\")\n\n if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n # OPA/EC requires structured data input, add clamAV log into json\n jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o json \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o appstudio \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n\n if [ -n \"$raw_manifest\" ]; then\n media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n # Determine if this is an OCI artifact (not a container image)\n # OCI artifacts typically have:\n # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n # - An explicit artifactType field that is not a container image type\n is_oci_artifact=false\n\n # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n is_oci_artifact=true\n fi\n\n # Check if artifactType is set and is not a container image type\n if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n is_oci_artifact=true\n fi\n\n if [ \"$is_oci_artifact\" = true ]; then\n # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n # This looks like a container image manifest, but get_image_manifests failed\n echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n else\n # Likely an OCI artifact with non-standard media type\n echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n fi\n else\n echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n echo \"Detected container image. Processing image manifests.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n # Proceed only if a specific arch is provided.\n # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n if [ -n \"$IMAGE_ARCH\" ]; then\n arch=\"${IMAGE_ARCH#*/}\"\n if [ \"${arch}\" = \"x86_64\" ]; then\n arch=\"amd64\"\n fi\n\n # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n arch=\"amd64\"\n ;;\n esac\n\n image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n fi\n\n while read -r arch arch_sha; do\n destination=\"content-${arch}\"\n mkdir -p \"$destination\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n exit 0\n fi\n\n # Scan and process container image for this architecture\n scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n {\n \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n \"namespace\" : $item.namespace,\n \"successes\" : (.successes + $item.successes),\n \"failures\" : (.failures + $item.failures),\n \"warnings\" : (.warnings + $item.warnings),\n \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_UPLOAD", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "IMAGE_DIGEST", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n echo \"Upload skipped by parameter.\"\n exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n MEDIA_TYPE=text/vnd.clamav\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n MEDIA_TYPE=application/vnd.konflux.test_output+json\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n echo \"No files found. Skipping upload.\"\n exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n", "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" } ], "volumes": [ { "emptyDir": {}, "name": "dbfolder" }, { "emptyDir": {}, "name": "work" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/commit_sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gsjcir", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537109186", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-7g9x2", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee/records/3544abc1-1746-40ca-bfa4-819399ad0ebc", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}", "results.tekton.dev/result": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8511962eff22b59cfd9661580edff4f0-98520691e1474956-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:40:04Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRunUID": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2-init", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "uid": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee" } ], "resourceVersion": "87452", "uid": "3544abc1-1746-40ca-bfa4-819399ad0ebc" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:40:10Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:40:10Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozak-on-pull-request-7g9x2-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "spanContext": { "traceparent": "00-8511962eff22b59cfd9661580edff4f0-98520691e1474956-01" }, "startTime": "2026-05-19T11:40:04Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "init", "provenance": {}, "terminated": { "containerID": "cri-o://56e3e3be266aa0a41a478b241f1e0afe8fe29190757e00a0a23f9682c2e01867", "exitCode": 0, "finishedAt": "2026-05-19T11:40:09Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:09Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/commit_sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-gsjcir", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537109186", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-7g9x2", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee/records/6d83143b-3a2c-4b47-afe4-54e71b2d35c8", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"80d5e38a2cdd9405c71f286894de34a2900f75c0\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}", "results.tekton.dev/result": "build-e2e-xudt/results/0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8511962eff22b59cfd9661580edff4f0-031952ba0ccf4dda-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:43:08Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "80d5e38a2cdd9405c71f286894de34a2900f75c0", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "tekton.dev/pipelineRunUID": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee", "tekton.dev/pipelineTask": "tpa-scan", "tekton.dev/task": "tpa-scan", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2-tpa-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-7g9x2", "uid": "0a021c56-298e-45cc-ac27-b9a2ec1f8cee" } ], "resourceVersion": "92267", "uid": "6d83143b-3a2c-4b47-afe4-54e71b2d35c8" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "tpa-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:24Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:24Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozd029e57fec094a40078fb8edc73c5ee6-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, "entryPoint": "tpa-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\", \"digests\": [\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\"]}}\n" }, { "name": "REPORTS", "type": "string", "value": "{\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\":\"sha256:4d18b4b23fb15777afa98a689f2b32dccc50eb54db11382032c2d6798ae2f73f\"}\n" }, { "name": "SCAN_OUTPUT", "type": "string", "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":48,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:43:24+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-8511962eff22b59cfd9661580edff4f0-031952ba0ccf4dda-01" }, "startTime": "2026-05-19T11:43:09Z", "steps": [ { "container": "step-get-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "get-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://b4509d4e9f6dc36520733e07d7b4a498b8e9750cf08ada786ea71be7789657a8", "exitCode": 0, "finishedAt": "2026-05-19T11:43:16Z", "reason": "Completed", "startedAt": "2026-05-19T11:43:14Z" }, "terminationReason": "Completed" }, { "container": "step-oci-attach-report", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "provenance": {}, "terminated": { "containerID": "cri-o://9be992b9f4213405e12d0298e8bfb81ba489dd20daf9df031c08d86d4e0c60ba", "exitCode": 0, "finishedAt": "2026-05-19T11:43:18Z", "reason": "Completed", "startedAt": "2026-05-19T11:43:16Z" }, "terminationReason": "Completed" }, { "container": "step-conftest-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "conftest-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://f59e08bd7d5d1108e62fc69ee4b89e829c7facc511e06217316001005cdb88fd", "exitCode": 0, "finishedAt": "2026-05-19T11:43:24Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0\\\", \\\"digests\\\": [\\\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445\\\":\\\"sha256:4d18b4b23fb15777afa98a689f2b32dccc50eb54db11382032c2d6798ae2f73f\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":48,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:24+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:19Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "The platform which will be scanned by this task.", "name": "image-platform", "type": "string" }, { "default": "https://exhort.stage.devshift.net/api/v5/analysis", "description": "The url of the TPA instance which will be used for scanning.", "name": "tpa-url", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-oci-attach-report", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "TPA scan result.", "name": "SCAN_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" }, { "description": "Mapping of image digests to report digests", "name": "REPORTS", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "800m", "memory": "2Gi" }, "requests": { "cpu": "800m", "memory": "2Gi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" }, { "name": "IMAGE_DIGEST", "value": "sha256:d0e20c98598844448bc6a7df97c93a465490375e52ca92c91fdab3138be94445" }, { "name": "IMAGE_PLATFORM" }, { "name": "TPA_URL", "value": "https://exhort.stage.devshift.net/api/v5/analysis" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "imagePullPolicy": "Always", "name": "get-vulnerabilities", "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n done\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n\ntpa_scan() {\n local sbom_file=${1}\n local arch=${2}\n local sbom_format\n\n sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n local arch=\"$1\"\n local sha_file=\"image-manifest-${arch}.sha\"\n local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n local arch_sha=\"\"\n\n if [ -e \"${sha_file}\" ]; then\n arch_sha=$(\u003c\"${sha_file}\")\n arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n else\n echo \"Couldn't find the SHA file for the requested architecture.\"\n exit 1\n fi\n\n echo \"Selecting auth\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Attempt to download the SBOM file via cosign\n\n if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n echo \"Unable to download SBOM for the architecture ${arch}.\"\n exit 1\n fi\n\n if [ -e \"${sbom_file_path}\" ]; then\n local arch_sha\n arch_sha=$(\u003c\"$sha_file\")\n\n echo \"Running TPA scan on $arch image manifest...\"\n tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n else\n echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n exit 1\n fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n # Validate against supported arch list. If it's not a known arch, fallback to amd64\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 1\n ;;\n esac\n\n run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n for sha_file in image-manifest-*.sha; do\n if [ -e \"$sha_file\" ]; then\n arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n run_tpa_on_arch \"$arch\"\n fi\n done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_OCI_ATTACH_REPORT", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-80d5e38a2cdd9405c71f286894de34a2900f75c0" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n echo 'OCI attach report skipped by parameter.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n echo 'No TPA reports generated. Skipping upload.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n report_file=\"$1\"\n arch=\"${report_file/*-}\"\n echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n image_ref=\"${repository}@${digest}\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n echo \"Attaching $f to ${image_ref}\"\n if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n then\n echo \"Failed to attach ${f} to ${image_ref}\"\n exit 1\n fi\n # shellcheck disable=SC2016\n reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "conftest-vulnerabilities", "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n if [ ! -s \"$file\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n else\n /usr/bin/conftest test --no-fail $file \\\n --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n fi\n\n #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n result=$(jq -rce \\\n '{\n vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n },\n unpatched_vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n }\n }' \"$file\")\n\n scan_result=$(jq -s -rce \\\n '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/commit_sha": "4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uilbnm", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537094607", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-s6q6q", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2/records/a8496857-44c3-468f-9100-e559a509b686", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "virus, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db1dcf7d8e317492d30931804712ebee-cd06fc5e399d9476-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:38:54Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRunUID": "a6fd6532-085f-49d9-8167-57532fd6ecd2", "tekton.dev/pipelineTask": "clamav-scan", "tekton.dev/task": "clamav-scan-min", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q-clamav-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "uid": "a6fd6532-085f-49d9-8167-57532fd6ecd2" } ], "resourceVersion": "86389", "uid": "a8496857-44c3-468f-9100-e559a509b686" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:39:49Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:39:49Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-oz88af6e3e1b5eef5b4cd3ef3b028c95ca-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, "entryPoint": "clamav-scan-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\", \"digests\": [\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779190786\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n" } ], "spanContext": { "traceparent": "00-db1dcf7d8e317492d30931804712ebee-cd06fc5e399d9476-01" }, "startTime": "2026-05-19T11:38:54Z", "steps": [ { "container": "step-extract-and-scan-image", "imageID": "quay.io/konflux-ci/clamav-db@sha256:2ee72ac5cda517125824c8139ade1dbf21ee93377e78ece9ef24ec0c55518fe9", "name": "extract-and-scan-image", "provenance": {}, "terminated": { "containerID": "cri-o://5a0f2995c5525e9f99dbe919cd1400839512cc758eb894b7dbf9e61c277d2a5a", "exitCode": 0, "finishedAt": "2026-05-19T11:39:46Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\\\", \\\"digests\\\": [\\\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190786\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:38:59Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://6656f502814d8b9ee57b858d3c62d4c243b17d59a663941f90763a9d7e0096d1", "exitCode": 0, "finishedAt": "2026-05-19T11:39:49Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\\\", \\\"digests\\\": [\\\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190786\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:39:47Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image arch.", "name": "image-arch", "type": "string" }, { "default": "", "description": "unused", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "8", "description": "Maximum number of threads clamd runs.", "name": "clamd-max-threads", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-upload", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "512m", "memory": "3Gi" }, "requests": { "cpu": "512m", "memory": "3Gi" } }, "env": [ { "name": "HOME", "value": "/work" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "IMAGE_DIGEST", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "IMAGE_ARCH" }, { "name": "MAX_THREADS", "value": "8" } ], "image": "quay.io/konflux-ci/clamav-db:latest", "name": "extract-and-scan-image", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n mkdir -p ~/.docker\n echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n# $1: destination - path to the content to scan\n# $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n# $3: digest - digest to add to digests_processed array\n# $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n local destination=\"$1\"\n local suffix=\"$2\"\n local digest=\"$3\"\n local scan_message=\"${4:-Scanning content}\"\n\n db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n echo \"$scan_message. This operation may take a while.\"\n clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n digests_processed+=(\"\\\"$digest\\\"\")\n\n if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n # OPA/EC requires structured data input, add clamAV log into json\n jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o json \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o appstudio \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n\n if [ -n \"$raw_manifest\" ]; then\n media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n # Determine if this is an OCI artifact (not a container image)\n # OCI artifacts typically have:\n # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n # - An explicit artifactType field that is not a container image type\n is_oci_artifact=false\n\n # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n is_oci_artifact=true\n fi\n\n # Check if artifactType is set and is not a container image type\n if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n is_oci_artifact=true\n fi\n\n if [ \"$is_oci_artifact\" = true ]; then\n # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n # This looks like a container image manifest, but get_image_manifests failed\n echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n else\n # Likely an OCI artifact with non-standard media type\n echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n fi\n else\n echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n echo \"Detected container image. Processing image manifests.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n # Proceed only if a specific arch is provided.\n # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n if [ -n \"$IMAGE_ARCH\" ]; then\n arch=\"${IMAGE_ARCH#*/}\"\n if [ \"${arch}\" = \"x86_64\" ]; then\n arch=\"amd64\"\n fi\n\n # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n arch=\"amd64\"\n ;;\n esac\n\n image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n fi\n\n while read -r arch arch_sha; do\n destination=\"content-${arch}\"\n mkdir -p \"$destination\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n exit 0\n fi\n\n # Scan and process container image for this architecture\n scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n {\n \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n \"namespace\" : $item.namespace,\n \"successes\" : (.successes + $item.successes),\n \"failures\" : (.failures + $item.failures),\n \"warnings\" : (.warnings + $item.warnings),\n \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_UPLOAD", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "IMAGE_DIGEST", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n echo \"Upload skipped by parameter.\"\n exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n MEDIA_TYPE=text/vnd.clamav\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n MEDIA_TYPE=application/vnd.konflux.test_output+json\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n echo \"No files found. Skipping upload.\"\n exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n", "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" } ], "volumes": [ { "emptyDir": {}, "name": "dbfolder" }, { "emptyDir": {}, "name": "work" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/commit_sha": "4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uilbnm", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537094607", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-s6q6q", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2/records/a198d128-2707-4d96-9ebf-9677ecf287d6", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db1dcf7d8e317492d30931804712ebee-bdcd6e835d47e443-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:35:52Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRunUID": "a6fd6532-085f-49d9-8167-57532fd6ecd2", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q-init", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "uid": "a6fd6532-085f-49d9-8167-57532fd6ecd2" } ], "resourceVersion": "81532", "uid": "a198d128-2707-4d96-9ebf-9677ecf287d6" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:35:58Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:35:58Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozak-on-pull-request-s6q6q-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "spanContext": { "traceparent": "00-db1dcf7d8e317492d30931804712ebee-bdcd6e835d47e443-01" }, "startTime": "2026-05-19T11:35:52Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "init", "provenance": {}, "terminated": { "containerID": "cri-o://b9b0429e4773ed79b2be1094e7b6ed652c4d0fd61c7327985b372404eb9e0e09", "exitCode": 0, "finishedAt": "2026-05-19T11:35:57Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:35:57Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/commit_sha": "4072b1e33823e8b78accf3356b3e53d802098808", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uilbnm", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537094607", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-pull-request-s6q6q", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2/records/e7ec4dc0-0089-4dbb-99c2-036b8fad233b", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"4072b1e33823e8b78accf3356b3e53d802098808\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/a6fd6532-085f-49d9-8167-57532fd6ecd2", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db1dcf7d8e317492d30931804712ebee-8feab7dcdb6b8bd2-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-ozak" }, "creationTimestamp": "2026-05-19T11:38:55Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "4072b1e33823e8b78accf3356b3e53d802098808", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "tekton.dev/pipelineRunUID": "a6fd6532-085f-49d9-8167-57532fd6ecd2", "tekton.dev/pipelineTask": "tpa-scan", "tekton.dev/task": "tpa-scan", "test.appstudio.openshift.io/pr-group-sha": "609db2d527d4a509b2f5ef27d4127d70bde1351db142e4c9c64f6289b4eaad" }, "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q-tpa-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-pull-request-s6q6q", "uid": "a6fd6532-085f-49d9-8167-57532fd6ecd2" } ], "resourceVersion": "85725", "uid": "e7ec4dc0-0089-4dbb-99c2-036b8fad233b" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "tpa-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:39:09Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:39:09Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-oz864b30d8fc035d80e924bd7db85121a6-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, "entryPoint": "tpa-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\", \"digests\": [\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\"]}}\n" }, { "name": "REPORTS", "type": "string", "value": "{\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\":\"sha256:48f5df7c98377a0daa8649b45ecec88c21ef9fa03633b7be10a56e838e1ac65a\"}\n" }, { "name": "SCAN_OUTPUT", "type": "string", "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":48,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:39:09+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-db1dcf7d8e317492d30931804712ebee-8feab7dcdb6b8bd2-01" }, "startTime": "2026-05-19T11:38:55Z", "steps": [ { "container": "step-get-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "get-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://ca22c1f4f198842bcff237c8752cc69786cedb099128aba51dd33b9e03695d0b", "exitCode": 0, "finishedAt": "2026-05-19T11:39:01Z", "reason": "Completed", "startedAt": "2026-05-19T11:38:59Z" }, "terminationReason": "Completed" }, { "container": "step-oci-attach-report", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "provenance": {}, "terminated": { "containerID": "cri-o://dcacb60a247dfc0d0f590c1ab066e9f08341afaa726be0ecb1f7d670959ad277", "exitCode": 0, "finishedAt": "2026-05-19T11:39:04Z", "reason": "Completed", "startedAt": "2026-05-19T11:39:02Z" }, "terminationReason": "Completed" }, { "container": "step-conftest-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "conftest-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://33db13a928c769e13e1e7d1f2626e1f3a6a461ac550575044738bedb2e0810f5", "exitCode": 0, "finishedAt": "2026-05-19T11:39:09Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808\\\", \\\"digests\\\": [\\\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8\\\":\\\"sha256:48f5df7c98377a0daa8649b45ecec88c21ef9fa03633b7be10a56e838e1ac65a\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":48,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:39:09+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:39:05Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "The platform which will be scanned by this task.", "name": "image-platform", "type": "string" }, { "default": "https://exhort.stage.devshift.net/api/v5/analysis", "description": "The url of the TPA instance which will be used for scanning.", "name": "tpa-url", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-oci-attach-report", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "TPA scan result.", "name": "SCAN_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" }, { "description": "Mapping of image digests to report digests", "name": "REPORTS", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "800m", "memory": "2Gi" }, "requests": { "cpu": "800m", "memory": "2Gi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" }, { "name": "IMAGE_DIGEST", "value": "sha256:735e24c266a2ea3292a20e05c769927c64bcfc8db4c77c356a48a7f4b82b08c8" }, { "name": "IMAGE_PLATFORM" }, { "name": "TPA_URL", "value": "https://exhort.stage.devshift.net/api/v5/analysis" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "imagePullPolicy": "Always", "name": "get-vulnerabilities", "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n done\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n\ntpa_scan() {\n local sbom_file=${1}\n local arch=${2}\n local sbom_format\n\n sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n local arch=\"$1\"\n local sha_file=\"image-manifest-${arch}.sha\"\n local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n local arch_sha=\"\"\n\n if [ -e \"${sha_file}\" ]; then\n arch_sha=$(\u003c\"${sha_file}\")\n arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n else\n echo \"Couldn't find the SHA file for the requested architecture.\"\n exit 1\n fi\n\n echo \"Selecting auth\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Attempt to download the SBOM file via cosign\n\n if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n echo \"Unable to download SBOM for the architecture ${arch}.\"\n exit 1\n fi\n\n if [ -e \"${sbom_file_path}\" ]; then\n local arch_sha\n arch_sha=$(\u003c\"$sha_file\")\n\n echo \"Running TPA scan on $arch image manifest...\"\n tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n else\n echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n exit 1\n fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n # Validate against supported arch list. If it's not a known arch, fallback to amd64\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 1\n ;;\n esac\n\n run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n for sha_file in image-manifest-*.sha; do\n if [ -e \"$sha_file\" ]; then\n arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n run_tpa_on_arch \"$arch\"\n fi\n done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_OCI_ATTACH_REPORT", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:on-pr-4072b1e33823e8b78accf3356b3e53d802098808" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n echo 'OCI attach report skipped by parameter.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n echo 'No TPA reports generated. Skipping upload.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n report_file=\"$1\"\n arch=\"${report_file/*-}\"\n echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n image_ref=\"${repository}@${digest}\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n echo \"Attaching $f to ${image_ref}\"\n if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n then\n echo \"Failed to attach ${f} to ${image_ref}\"\n exit 1\n fi\n # shellcheck disable=SC2016\n reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "conftest-vulnerabilities", "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n if [ ! -s \"$file\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n else\n /usr/bin/conftest test --no-fail $file \\\n --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n fi\n\n #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n result=$(jq -rce \\\n '{\n vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n },\n unpatched_vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n }\n }' \"$file\")\n\n scan_result=$(jq -s -rce \\\n '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/commit_sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jtxnsl", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537108878", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-74rs9", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492/records/2fa2b66d-0a1e-4924-a24d-4df7bff1f08b", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bd24a6e803660a298babd09432c7cb55-1f84067449a3171c-01\"}" }, "creationTimestamp": "2026-05-19T11:40:54Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRunUID": "27a968ed-f718-49fc-ab32-71b6240d3492", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah-oci-ta-min" }, "name": "gl-multi-component-child-ozak-on-push-74rs9-build-container", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-74rs9", "uid": "27a968ed-f718-49fc-ab32-71b6240d3492" } ], "resourceVersion": "91026", "uid": "2fa2b66d-0a1e-4924-a24d-4df7bff1f08b" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "" }, { "name": "COMMIT_SHA", "value": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:42:49Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:42:49Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozak-on-push-74rs9-build-container-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, "entryPoint": "buildah-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min" } }, "results": [ { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "SBOM_BLOB_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:33fb904dc7634c1cf99bf28c94518215c906a013d8e48483850638403d30a67c" } ], "spanContext": { "traceparent": "00-bd24a6e803660a298babd09432c7cb55-1f84067449a3171c-01" }, "startTime": "2026-05-19T11:40:54Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://b89df0bcf1e99ad1df62abbe59da5a7be8089836757d0770c46281fc59fb7db9", "exitCode": 0, "finishedAt": "2026-05-19T11:41:00Z", "reason": "Completed", "startedAt": "2026-05-19T11:41:00Z" }, "terminationReason": "Completed" }, { "container": "step-build", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://aadb7a3d594d66cd684e1c96325af8da832324235e80099bc12baf1515d5fddd", "exitCode": 0, "finishedAt": "2026-05-19T11:41:14Z", "reason": "Completed", "startedAt": "2026-05-19T11:41:01Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://adcbe86bd1195f475989f2a497e2df85229b322414a5e14a6607f7885f55c786", "exitCode": 0, "finishedAt": "2026-05-19T11:41:47Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:14Z" }, "terminationReason": "Completed" }, { "container": "step-sbom-syft-generate", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "provenance": {}, "terminated": { "containerID": "cri-o://73774ae2e6cff8561199444d8a6336d918e8d0371bf6ae14b7cc27c69fc3cfae", "exitCode": 0, "finishedAt": "2026-05-19T11:42:03Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:47Z" }, "terminationReason": "Completed" }, { "container": "step-prepare-sboms", "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "provenance": {}, "terminated": { "containerID": "cri-o://08d938eb326f4446a00073bf699b99c0094fcaccb0ba80859404e36cb0cd680b", "exitCode": 0, "finishedAt": "2026-05-19T11:42:24Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:42:04Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://f373e5734ee34fb0a87203bb2451782057a88d61a5c03511b61bc4a3d75a59cc", "exitCode": 0, "finishedAt": "2026-05-19T11:42:48Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:33fb904dc7634c1cf99bf28c94518215c906a013d8e48483850638403d30a67c\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:42:25Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "ACTIVATION_KEY", "value": "activation-key" }, { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "ADD_CAPABILITIES" }, { "name": "ANNOTATIONS_FILE" }, { "name": "BUILD_ARGS_FILE" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXT", "value": "." }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "ENTITLEMENT_SECRET", "value": "etc-pki-entitlement" }, { "name": "HERMETIC", "value": "false" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "IMAGE_EXPIRES_AFTER" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SKIP_INJECTIONS", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "SQUASH", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "TARGET_STAGE" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "--build-args", "--env", "--labels", "--annotations" ], "computeResources": { "limits": { "cpu": "500m", "memory": "1Gi" }, "requests": { "cpu": "500m", "memory": "1Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n fi\n fi\n}\n\nfunction unset_proxy {\n echo \"[$(date --utc -Ins)] Unsetting proxy\"\n unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n # path is valid, do nothing\n ;;\n*)\n echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n echo \"Source path: $source_dir_path\" \u003e\u00262\n echo \"Resolved path: $context_dir_path\" \u003e\u00262\n exit 1\n ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n # Instrumented builds (SAST) use this custom dockerfile step as their base\n dockerfile_path=\"$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n while IFS= read -r line || [[ -n \"$line\" ]]; do\n # Skip empty lines and comments\n if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n ANNOTATIONS+=(\"--annotation\" \"$line\")\n fi\n done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --build-args)\n shift\n # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n build_args+=(\"$1\")\n shift\n done\n ;;\n --env)\n shift\n # Collect env entries of the form KEY=value\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n env_vars+=(\"$1\")\n shift\n done\n ;;\n --labels)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n LABELS+=(\"--label\" \"$1\")\n shift\n done\n ;;\n --annotations)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ANNOTATIONS+=(\"--annotation\" \"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--pull=never\")\n UNSHARE_ARGS+=(\"--net\")\n buildah_retries=3\n\n set_proxy\n\n for image in $BASE_IMAGES; do\n if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n echo \"Failed to pull base image ${image}\"\n exit 1\n fi\n done\n\n unset_proxy\n\n echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n BUILDAH_ARGS+=(\"--cap-add=all\")\n BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n fi\n if [ -n \"$BUILD_TIMESTAMP\" ]; then\n echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n exit 1\n fi\n # but do set it so that we get all the labels/annotations associated with it\n BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n # Identify the current arch to filter the prefetched content\n PREFETCH_ARCH=\"$(uname -m)\"\n echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n echo \"Prefetched content will be made available\"\n\n cp -r \"/var/workdir/cachi2\" /tmp/\n chmod -R go+rwX /tmp/cachi2\n\n # In case RPMs were prefetched and this is a multi-arch build,\n # clean up the packages that do not match the architecture being built\n RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n echo \"Removing prefetched RPMs from non-matching architectures\"\n PREFETCH_ARCH=\"$(uname -m)\"\n for path in \"$RPM_PREFETCH_DIR\"/*; do\n if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n echo \"Removing: $path\"\n rm -rf \"$path\"\n else\n echo \"Keeping: $path\"\n fi\n done\n fi\n\n VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n sed -E -i \\\n -e 'H;1h;$!d;x' \\\n -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n @igM' \\\n \"$dockerfile_copy\"\n\n prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n mkdir -p \"$YUM_REPOS_D_FETCHED\"\n if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n fi\n fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n \"--label\" \"architecture=$(uname -m)\"\n \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n FINAL_BASE_IMAGE=$(\n # Get the base image of the final stage\n # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n # Run the find_root_stage() function on the final stage\n # If the final stage is scratch or oci-archive, return empty\n jq -r '.Stages as $all_stages |\n def find_root_stage($stage):\n if $stage.From.Stage then\n find_root_stage($all_stages[$stage.From.Stage.Index])\n else\n $stage\n end;\n\n find_root_stage(.Stages[-1]) |\n if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n empty\n else\n .BaseName\n end' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n )\n if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n set_proxy\n buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n unset_proxy\n buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n if [[ \"$label\" != \"--label\" ]]; then\n label_pairs+=(\"$label\")\n fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n echo \"\" \u003e\u003e\"$dockerfile_copy\"\n # Always write labels.json to the new standard location\n echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n # Conditionally write to the old location for backward compatibility\n if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n cp \"$containerignore\" \"$ignorefile_copy\"\n {\n echo \"\"\n echo \"!/labels.json\"\n echo \"!/content-sets.json\"\n } \u003e\u003e\"$ignorefile_copy\"\n BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n mkdir -p /shared/rhsm/etc/pki/entitlement\n mkdir -p /shared/rhsm/etc/pki/consumer\n\n VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n echo \"Adding activation key to the build\"\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n echo \"Pre-registering with subscription manager.\"\n export RETRY_MAX_TRIES=6\n if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n echo \"Subscription-manager register failed\"\n exit 1\n fi\n unset RETRY_MAX_TRIES\n trap 'subscription-manager unregister || true' EXIT\n\n # copy generated certificates to /shared volume\n cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n exit 1\n fi\n # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n # (we set the workdir using 'unshare -w')\n context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n # Instrumented builds (SAST) use this step as their base and add some other tools.\n while read -r volume_mount; do\n VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n while read -r filename; do\n echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n buildah build\n \"${VOLUME_MOUNTS[@]}\"\n \"${BUILDAH_ARGS[@]}\"\n \"${LABELS[@]}\"\n \"${ANNOTATIONS[@]}\"\n --tls-verify=\"$TLSVERIFY\" --no-cache\n --ulimit nofile=4096:4096\n --http-proxy=false\n -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n # Get the image pullspec and filter out a tag if it is not set\n # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n # if buildah did not use that particular image during build because it was skipped\n if [ -n \"$base_image_digest\" ]; then\n echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "gl-multi-component-child-ozak-on-push-74rs9-build-container" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"; then\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n echo -n \"${IMAGE}@\"\n cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e/shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "256m", "memory": "512Mi" }, "requests": { "cpu": "256m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n syft_sbom_type=cyclonedx-json@1.5\n ;;\nspdx)\n syft_sbom_type=spdx-json@2.3\n ;;\n*)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ADDITIONAL_BASE_IMAGES+=(\"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/var/workdir/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "emptyDir": {}, "name": "shared" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/commit_sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jtxnsl", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537108878", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-74rs9", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492/records/820a9ace-837a-4c28-99af-7f6707aff894", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bd24a6e803660a298babd09432c7cb55-c10b3dded25bf26d-01\"}" }, "creationTimestamp": "2026-05-19T11:42:49Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRunUID": "27a968ed-f718-49fc-ab32-71b6240d3492", "tekton.dev/pipelineTask": "build-image-index", "tekton.dev/task": "build-image-index-min" }, "name": "gl-multi-component-child-ozak-on-push-74rs9-build-image-index", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-74rs9", "uid": "27a968ed-f718-49fc-ab32-71b6240d3492" } ], "resourceVersion": "91520", "uid": "820a9ace-837a-4c28-99af-7f6707aff894" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:42:59Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:42:59Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-oz886752d410e44d1e9fa5952a451b38a8-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, "entryPoint": "build-image-index-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min" } }, "results": [ { "name": "IMAGES", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" } ], "spanContext": { "traceparent": "00-bd24a6e803660a298babd09432c7cb55-c10b3dded25bf26d-01" }, "startTime": "2026-05-19T11:42:49Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://cf3f08ead080c9f8bd594b15a8236261c0edcf3042d3336e8e254744f8df3b5e", "exitCode": 0, "finishedAt": "2026-05-19T11:42:56Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:42:54Z" }, "terminationReason": "Completed" }, { "container": "step-create-sbom", "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://cde0af04741ba93940e4cbebb5a6485ab2bff1b2b5cf5f34e6fcced48598fc8c", "exitCode": 0, "finishedAt": "2026-05-19T11:42:57Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:42:57Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://ae04eade3b943f8cf8a7fad8888e04eeda15058869749a179daef4b0c31b06d3", "exitCode": 0, "finishedAt": "2026-05-19T11:42:59Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:42:57Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This takes existing Image Manifests and combines them in an Image Index.", "params": [ { "description": "The target image and tag where the image will be pushed to.", "name": "IMAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "description": "List of Image Manifests to be referenced by the Image Index", "name": "IMAGES", "type": "array" }, { "default": "true", "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.", "name": "ALWAYS_BUILD_INDEX", "type": "string" }, { "default": "vfs", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": "false", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "List of all referenced image manifests", "name": "IMAGES", "type": "string" }, { "description": "Image reference of the built image containing both the repository and the digest", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "vfs" } ], "volumeMounts": [ { "mountPath": "/index-build-data", "name": "shared-dir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1@sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n --image \"$IMAGE\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --buildah-format \"$BUILDAH_FORMAT\" \\\n --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n --additional-tags \"gl-multi-component-child-ozak-on-push-74rs9-build-image-index\" \\\n --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n --result-path-images \"/tekton/results/IMAGES\" \\\n --images \"$@\"; then\n echo \"Failed to build image index\"\n exit 1\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-index\n --index-image-pullspec \"$IMAGE_URL\"\n --index-image-digest \"$IMAGE_DIGEST\"\n --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 } } ], "volumes": [ { "emptyDir": {}, "name": "shared-dir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/commit_sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jtxnsl", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537108878", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-74rs9", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492/records/8a8cda62-ac72-4677-a2aa-bef72df3a456", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bd24a6e803660a298babd09432c7cb55-27596139ca785d03-01\"}" }, "creationTimestamp": "2026-05-19T11:43:00Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRunUID": "27a968ed-f718-49fc-ab32-71b6240d3492", "tekton.dev/pipelineTask": "clamav-scan" }, "name": "gl-multi-component-child-ozak-on-push-74rs9-clamav-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-74rs9", "uid": "27a968ed-f718-49fc-ab32-71b6240d3492" } ], "resourceVersion": "93559", "uid": "8a8cda62-ac72-4677-a2aa-bef72df3a456" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:05Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:05Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozak-on-push-74rs9-clamav-scan-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, "entryPoint": "clamav-scan-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\", \"digests\": [\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779191042\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n" } ], "spanContext": { "traceparent": "00-bd24a6e803660a298babd09432c7cb55-27596139ca785d03-01" }, "startTime": "2026-05-19T11:43:00Z", "steps": [ { "container": "step-extract-and-scan-image", "imageID": "quay.io/konflux-ci/clamav-db@sha256:2ee72ac5cda517125824c8139ade1dbf21ee93377e78ece9ef24ec0c55518fe9", "name": "extract-and-scan-image", "provenance": {}, "terminated": { "containerID": "cri-o://124d01046acf059ab6223907628b697007afcca820c02546dffb4bef49b4d281", "exitCode": 0, "finishedAt": "2026-05-19T11:44:02Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\\\", \\\"digests\\\": [\\\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779191042\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:05Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://7615bda758a340f8b815f112362ea9bab4ef41a5acd1a3cfddb1ad40589c4e44", "exitCode": 0, "finishedAt": "2026-05-19T11:44:05Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\\\", \\\"digests\\\": [\\\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779191042\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:02Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image arch.", "name": "image-arch", "type": "string" }, { "default": "", "description": "unused", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "8", "description": "Maximum number of threads clamd runs.", "name": "clamd-max-threads", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-upload", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "512m", "memory": "3Gi" }, "requests": { "cpu": "512m", "memory": "3Gi" } }, "env": [ { "name": "HOME", "value": "/work" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "IMAGE_DIGEST", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "IMAGE_ARCH" }, { "name": "MAX_THREADS", "value": "8" } ], "image": "quay.io/konflux-ci/clamav-db:latest", "name": "extract-and-scan-image", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n mkdir -p ~/.docker\n echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n# $1: destination - path to the content to scan\n# $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n# $3: digest - digest to add to digests_processed array\n# $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n local destination=\"$1\"\n local suffix=\"$2\"\n local digest=\"$3\"\n local scan_message=\"${4:-Scanning content}\"\n\n db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n echo \"$scan_message. This operation may take a while.\"\n clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n digests_processed+=(\"\\\"$digest\\\"\")\n\n if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n # OPA/EC requires structured data input, add clamAV log into json\n jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o json \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o appstudio \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n\n if [ -n \"$raw_manifest\" ]; then\n media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n # Determine if this is an OCI artifact (not a container image)\n # OCI artifacts typically have:\n # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n # - An explicit artifactType field that is not a container image type\n is_oci_artifact=false\n\n # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n is_oci_artifact=true\n fi\n\n # Check if artifactType is set and is not a container image type\n if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n is_oci_artifact=true\n fi\n\n if [ \"$is_oci_artifact\" = true ]; then\n # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n # This looks like a container image manifest, but get_image_manifests failed\n echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n else\n # Likely an OCI artifact with non-standard media type\n echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n fi\n else\n echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n echo \"Detected container image. Processing image manifests.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n # Proceed only if a specific arch is provided.\n # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n if [ -n \"$IMAGE_ARCH\" ]; then\n arch=\"${IMAGE_ARCH#*/}\"\n if [ \"${arch}\" = \"x86_64\" ]; then\n arch=\"amd64\"\n fi\n\n # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n arch=\"amd64\"\n ;;\n esac\n\n image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n fi\n\n while read -r arch arch_sha; do\n destination=\"content-${arch}\"\n mkdir -p \"$destination\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n exit 0\n fi\n\n # Scan and process container image for this architecture\n scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n {\n \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n \"namespace\" : $item.namespace,\n \"successes\" : (.successes + $item.successes),\n \"failures\" : (.failures + $item.failures),\n \"warnings\" : (.warnings + $item.warnings),\n \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_UPLOAD", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "IMAGE_DIGEST", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n echo \"Upload skipped by parameter.\"\n exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n MEDIA_TYPE=text/vnd.clamav\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n MEDIA_TYPE=application/vnd.konflux.test_output+json\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n echo \"No files found. Skipping upload.\"\n exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n", "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" } ], "volumes": [ { "emptyDir": {}, "name": "dbfolder" }, { "emptyDir": {}, "name": "work" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/commit_sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jtxnsl", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537108878", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-74rs9", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492/records/9fe16d95-3fba-4cb0-8e8f-e56af45c9f45", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone oci trusted artifacts", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bd24a6e803660a298babd09432c7cb55-b83c3798a901a70f-01\"}" }, "creationTimestamp": "2026-05-19T11:40:02Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRunUID": "27a968ed-f718-49fc-ab32-71b6240d3492", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone-oci-ta-min" }, "name": "gl-multi-component-child-ozak-on-push-74rs9-clone-repository", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-74rs9", "uid": "27a968ed-f718-49fc-ab32-71b6240d3492" } ], "resourceVersion": "87570", "uid": "9fe16d95-3fba-4cb0-8e8f-e56af45c9f45" }, "spec": { "params": [ { "name": "url", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "revision", "value": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1.git" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "basic-auth", "secret": { "secretName": "pac-gitauth-jtxnsl" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:40:12Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:40:12Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-oza7e00aef245b7e4908e4339d1550fb08-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, "entryPoint": "git-clone-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "commit", "type": "string", "value": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "commit-timestamp", "type": "string", "value": "1779190791" }, { "name": "short-commit", "type": "string", "value": "a6b4ba1" }, { "name": "url", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252" } ], "spanContext": { "traceparent": "00-bd24a6e803660a298babd09432c7cb55-b83c3798a901a70f-01" }, "startTime": "2026-05-19T11:40:02Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "provenance": {}, "terminated": { "containerID": "cri-o://8f85704b8e07281a2a1d20de4e74ddb1cbb4023ce37be0e24863e63dc5143eec", "exitCode": 0, "finishedAt": "2026-05-19T11:40:09Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190791\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a6b4ba1\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:09Z" }, "terminationReason": "Completed" }, { "container": "step-symlink-check", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "provenance": {}, "terminated": { "containerID": "cri-o://518a26a27d24d65741a2b19e635fcc188490f3a442d9f3494f739851f9a42c83", "exitCode": 0, "finishedAt": "2026-05-19T11:40:10Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190791\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a6b4ba1\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:10Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://6d561ef81ee38d79158c9e8f8a442b377ab4874c5b94f476ab5c3bbe18f64710", "exitCode": 0, "finishedAt": "2026-05-19T11:40:11Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252\",\"type\":1},{\"key\":\"commit\",\"value\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190791\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a6b4ba1\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:10Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.", "params": [ { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "7", "description": "Length of short commit SHA", "name": "shortCommitLength", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n", "name": "submodulePaths", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "/tekton/home", "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n", "name": "userHome", "type": "string" }, { "default": "false", "description": "Log the commands that are executed during `git-clone`'s operation.", "name": "verbose", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" }, { "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" } ], "steps": [ { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "PARAM_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "PARAM_REVISION", "value": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "PARAM_REFSPEC" }, { "name": "PARAM_SUBMODULES", "value": "true" }, { "name": "PARAM_SUBMODULE_PATHS" }, { "name": "PARAM_DEPTH", "value": "1" }, { "name": "PARAM_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "PARAM_SSL_VERIFY", "value": "true" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "PARAM_VERBOSE", "value": "false" }, { "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "PARAM_USER_HOME", "value": "/tekton/home" }, { "name": "PARAM_FETCH_TAGS", "value": "false" }, { "name": "PARAM_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "PARAM_TARGET_BRANCH", "value": "main" }, { "name": "PARAM_MERGE_SOURCE_REPO_URL" }, { "name": "PARAM_MERGE_SOURCE_DEPTH" }, { "name": "WORKSPACE_SSH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_SSH_DIRECTORY_PATH" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND", "value": "true" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH", "value": "/workspace/basic-auth" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n # Compatibility with kubernetes.io/basic-auth secrets\n elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n else\n echo \"Unknown basic-auth workspace format\"\n exit 1\n fi\n chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n -url=\"${PARAM_URL}\" \\\n -revision=\"${PARAM_REVISION}\" \\\n -refspec=\"${PARAM_REFSPEC}\" \\\n -path=\"${CHECKOUT_DIR}\" \\\n -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n -submodules=\"${PARAM_SUBMODULES}\" \\\n -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n -depth=\"${PARAM_DEPTH}\" \\\n -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n # Determine if merging from a different repository or the same one\n if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n normalize_url() {\n echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n }\n\n NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n MERGE_REMOTE=\"origin\"\n else\n echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n echo \"Adding remote 'merge-source'...\"\n git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n MERGE_REMOTE=\"merge-source\"\n fi\n else\n echo \"Merging from the same repository (origin)\"\n MERGE_REMOTE=\"origin\"\n fi\n\n echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n else\n retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n fi\n\n echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n git config --global user.email \"tekton-git-clone@tekton.dev\"\n git config --global user.name \"Tekton Git Clone Task\"\n\n if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n echo \"--- Git Status ---\"\n git status\n echo \"------------------\"\n exit 1\n fi\n\n # Check if there are changes staged for commit\n if git diff --staged --quiet; then\n echo \"No diff was found, skipping merge...\" \u003e\u00262\n else\n echo \"Merge successful (no conflicts found), committing...\"\n if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n exit 1\n fi\n MERGED_SHA=$(git rev-parse HEAD)\n echo \"New HEAD after merge: ${MERGED_SHA}\"\n echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n fi\n\nelse\n echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n echo \"Fetching tags\"\n retry git fetch --tags\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "computeResources": {}, "env": [ { "name": "PARAM_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n while read -r symlink; do\n target=$(readlink -m \"$symlink\")\n if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n fi\n done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n return 1\n fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n echo \"Running symlink check\"\n check_symlinks\nfi\n", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1.git", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/commit_sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jtxnsl", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537108878", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-74rs9", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492/records/0f998aad-ba26-4665-94f6-a311e00f4485", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bd24a6e803660a298babd09432c7cb55-2dbe8b6b2fc792af-01\"}" }, "creationTimestamp": "2026-05-19T11:39:56Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRunUID": "27a968ed-f718-49fc-ab32-71b6240d3492", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init" }, "name": "gl-multi-component-child-ozak-on-push-74rs9-init", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-74rs9", "uid": "27a968ed-f718-49fc-ab32-71b6240d3492" } ], "resourceVersion": "86839", "uid": "0f998aad-ba26-4665-94f6-a311e00f4485" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:40:02Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:40:02Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozak-on-push-74rs9-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "spanContext": { "traceparent": "00-bd24a6e803660a298babd09432c7cb55-2dbe8b6b2fc792af-01" }, "startTime": "2026-05-19T11:39:56Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "init", "provenance": {}, "terminated": { "containerID": "cri-o://db3873fcfb91a6e601d137ceafa4552e6c2f441a372f6db4af02a6370edc2b45", "exitCode": 0, "finishedAt": "2026-05-19T11:40:01Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:01Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/commit_sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jtxnsl", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537108878", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-74rs9", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492/records/66439073-079c-4baf-a5a8-92e1bbb0c71d", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bd24a6e803660a298babd09432c7cb55-bab75dc4e8659719-01\"}" }, "creationTimestamp": "2026-05-19T11:43:00Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRunUID": "27a968ed-f718-49fc-ab32-71b6240d3492", "tekton.dev/pipelineTask": "rpms-signature-scan", "tekton.dev/task": "rpms-signature-scan" }, "name": "gl-multi-component-child-ozak-on-push-74rs9-rpms-signature-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-74rs9", "uid": "27a968ed-f718-49fc-ab32-71b6240d3492" } ], "resourceVersion": "92053", "uid": "66439073-079c-4baf-a5a8-92e1bbb0c71d" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "image-digest", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:14Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:14Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-oz5a3b760cb0b2e3a79a2f1ea8273be871-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, "entryPoint": "rpms-signature-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\", \"digests\": [\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\"]}}\n" }, { "name": "RPMS_DATA", "type": "string", "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:43:13+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-bd24a6e803660a298babd09432c7cb55-bab75dc4e8659719-01" }, "startTime": "2026-05-19T11:43:00Z", "steps": [ { "container": "step-rpms-signature-scan", "imageID": "quay.io/konflux-ci/tools@sha256:0d2fbb45b33949aa7474157b7cae3a55d3a399405fd8bef75dd73d0bee96890a", "name": "rpms-signature-scan", "provenance": {}, "terminated": { "containerID": "cri-o://66fda24bcbbf1b24e545037479d28efdf984f5abdff0feda31c5dff08ec08378", "exitCode": 0, "finishedAt": "2026-05-19T11:43:13Z", "reason": "Completed", "startedAt": "2026-05-19T11:43:06Z" }, "terminationReason": "Completed" }, { "container": "step-output-results", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "provenance": {}, "terminated": { "containerID": "cri-o://2c495e8e1d5a74797fe4847427f6c901d1fd74453b09db04cd7f33812428ffcf", "exitCode": 0, "finishedAt": "2026-05-19T11:43:14Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\\\", \\\"digests\\\": [\\\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:13+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:13Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans RPMs in an image and provide information about RPMs signatures.", "params": [ { "description": "Image URL", "name": "image-url", "type": "string" }, { "description": "Image digest to scan", "name": "image-digest", "type": "string" }, { "default": "/tmp", "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n", "name": "workdir", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Information about signed and unsigned RPMs", "name": "RPMS_DATA", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "200m", "memory": "256Mi" }, "requests": { "cpu": "200m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "IMAGE_DIGEST", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/tools@sha256:cdab2b0f6e01ed7852ad4c5376fd58bdbfe0db1379dd5acf42aad722a0f1e168", "name": "rpms-signature-scan", "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n --image-url \"${IMAGE_URL}\" \\\n --image-digest \"${IMAGE_DIGEST}\" \\\n --workdir \"${WORKDIR}\" \\\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "50m", "memory": "32Mi" }, "requests": { "cpu": "50m", "memory": "32Mi" } }, "env": [ { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/commit_sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jtxnsl", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537108878", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-74rs9", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492/records/c5fe7d88-8585-46dd-9bca-de971a041149", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bd24a6e803660a298babd09432c7cb55-4067a45a6a30b4ca-01\"}" }, "creationTimestamp": "2026-05-19T11:43:00Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRunUID": "27a968ed-f718-49fc-ab32-71b6240d3492", "tekton.dev/pipelineTask": "sast-shell-check", "tekton.dev/task": "sast-shell-check-oci-ta-min" }, "name": "gl-multi-component-child-ozak-on-push-74rs9-sast-shell-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-74rs9", "uid": "27a968ed-f718-49fc-ab32-71b6240d3492" } ], "resourceVersion": "92178", "uid": "c5fe7d88-8585-46dd-9bca-de971a041149" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-shell-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:18Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:18Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-oz9dfd3ba2d549e3158b19003c1511aac7-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, "entryPoint": "sast-shell-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:43:16+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-bd24a6e803660a298babd09432c7cb55-4067a45a6a30b4ca-01" }, "startTime": "2026-05-19T11:43:00Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://d03f501a89f7bd26c9e3bcca22bff4cac9918599550eb18490ecced51953bf5b", "exitCode": 0, "finishedAt": "2026-05-19T11:43:05Z", "reason": "Completed", "startedAt": "2026-05-19T11:43:05Z" }, "terminationReason": "Completed" }, { "container": "step-sast-shell-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-shell-check", "provenance": {}, "terminated": { "containerID": "cri-o://329135af0bdab50dc1576a301a0b62e850d0a57801fa8cce5db9f175ef8d783e", "exitCode": 0, "finishedAt": "2026-05-19T11:43:16Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:16+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:06Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://abd79dd83ba29d6bce2391b05d89ffbeca56e5d00196b335238f334879c42a7f", "exitCode": 0, "finishedAt": "2026-05-19T11:43:17Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:16+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:16Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "true", "description": "Whether to include important findings only", "name": "IMP_FINDINGS_ONLY", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Image digest to report findings for.", "name": "image-digest", "type": "string" }, { "default": "", "description": "Image URL.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "128m", "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "IMP_FINDINGS_ONLY", "value": "true" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-shell-check", "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n resolved_path=$(realpath -m \"$potential_path\")\n\n # ensure resolved path is still within SOURCE_CODE_DIR\n if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n ALL_TARGETS+=(\"$resolved_path\")\n else\n echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n exit 1\n fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n read -r quota period \u003c/sys/fs/cgroup/cpu.max\n if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n export SC_JOBS=$(((quota + period - 1) / period))\n echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n --mode=json\n --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n # predefined list of shellcheck important findings\n CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n CSGREP_OPTS+=(\n --event=\"$CSGREP_EVENT_FILTER\"\n )\nelse\n CSGREP_OPTS+=(\n --event=\"error|warning\"\n )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n echo \"Error occurred while running 'run-shellcheck.sh'\"\n note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n else\n mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "IMAGE_DIGEST", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n echo 'No image-url or image-digest param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n # Determine the media type based on the file extension\n if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n MEDIA_TYPE=\"application/json\"\n else\n MEDIA_TYPE=\"application/sarif+json\"\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n exit 1\n fi\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/commit_sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jtxnsl", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537108878", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-74rs9", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492/records/d35d2cc3-90fd-40cf-b5f9-3f0f4fe8700d", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bd24a6e803660a298babd09432c7cb55-9b89cc855891aad4-01\"}" }, "creationTimestamp": "2026-05-19T11:43:00Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRunUID": "27a968ed-f718-49fc-ab32-71b6240d3492", "tekton.dev/pipelineTask": "sast-unicode-check", "tekton.dev/task": "sast-unicode-check-oci-ta-min" }, "name": "gl-multi-component-child-ozak-on-push-74rs9-sast-unicode-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-74rs9", "uid": "27a968ed-f718-49fc-ab32-71b6240d3492" } ], "resourceVersion": "91829", "uid": "d35d2cc3-90fd-40cf-b5f9-3f0f4fe8700d" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:09Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:09Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozd9164f31f473ea5db50d58de0abc2014-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, "entryPoint": "sast-unicode-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:43:07+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-bd24a6e803660a298babd09432c7cb55-9b89cc855891aad4-01" }, "startTime": "2026-05-19T11:43:01Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://9a0cdde17ac168aca6e8855e9fb6d9ea647b90ed58c6082d27f83023cc832291", "exitCode": 0, "finishedAt": "2026-05-19T11:43:05Z", "reason": "Completed", "startedAt": "2026-05-19T11:43:05Z" }, "terminationReason": "Completed" }, { "container": "step-sast-unicode-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-unicode-check", "provenance": {}, "terminated": { "containerID": "cri-o://8a5828809035292b5c53f0ecba8de6b15522a3e2d7048a9bee1c3636ff002648", "exitCode": 0, "finishedAt": "2026-05-19T11:43:07Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:07+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:06Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://8a49c6eae6d111d34d8b35ccdf39b705b1a82c64065ee211978b26d619b2b243", "exitCode": 0, "finishedAt": "2026-05-19T11:43:08Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:07+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:07Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans source code for non-printable unicode characters in all text files.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "-p bidi -v -d -t", "description": "arguments for find-unicode-control command.", "name": "FIND_UNICODE_CONTROL_ARGS", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "description": "Image digest used for ORAS upload.", "name": "image-digest", "type": "string" }, { "description": "Image URL used for ORAS upload.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "FIND_UNICODE_CONTROL_ARGS", "value": "-p bidi -v -d -t" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_CODE_DIR", "value": "/var/workdir" }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-unicode-check", "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n \u003eraw_sast_unicode_check_out.txt \\\n 2\u003eraw_sast_unicode_check_out.log ||\n FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n echo \"Failed to run find-unicode-control command\" \u003e\u00262\n cat raw_sast_unicode_check_out.log\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n --mode=json\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"${SCAN_PROP}\"\n --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n cat processed_sast_unicode_check_out.err\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # Build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n # Append --record-excluded option if RECORD_EXCLUDED is true\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n else\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n echo \"sast-unicode-check test failed because of the following issues:\"\n cat sast_unicode_check_out.json\n TEST_OUTPUT=\n parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "IMAGE_DIGEST", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n echo 'No image-url param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n MEDIA_TYPE=application/json\n else\n MEDIA_TYPE=application/sarif+json\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/commit_sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jtxnsl", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537108878", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-74rs9", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492/records/36a5cc66-94e0-48e7-ba2e-d418d47fb5ea", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bd24a6e803660a298babd09432c7cb55-e1fd2b92b6e8495c-01\"}" }, "creationTimestamp": "2026-05-19T11:43:00Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRunUID": "27a968ed-f718-49fc-ab32-71b6240d3492", "tekton.dev/pipelineTask": "tpa-scan", "tekton.dev/task": "tpa-scan" }, "name": "gl-multi-component-child-ozak-on-push-74rs9-tpa-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-74rs9", "uid": "27a968ed-f718-49fc-ab32-71b6240d3492" } ], "resourceVersion": "92133", "uid": "36a5cc66-94e0-48e7-ba2e-d418d47fb5ea" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "tpa-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:16Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:16Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozak-on-push-74rs9-tpa-scan-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, "entryPoint": "tpa-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\", \"digests\": [\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\"]}}\n" }, { "name": "REPORTS", "type": "string", "value": "{\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\":\"sha256:c607a26f33cf8bc3399db9a69cd9598f0ac885ee3f18e7403c36d1251f09c48e\"}\n" }, { "name": "SCAN_OUTPUT", "type": "string", "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":48,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:43:15+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-bd24a6e803660a298babd09432c7cb55-e1fd2b92b6e8495c-01" }, "startTime": "2026-05-19T11:43:00Z", "steps": [ { "container": "step-get-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "get-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://3570da530041060e64d3d2a8269df4ea14b392846adbcf945d1604e05ab874f3", "exitCode": 0, "finishedAt": "2026-05-19T11:43:07Z", "reason": "Completed", "startedAt": "2026-05-19T11:43:05Z" }, "terminationReason": "Completed" }, { "container": "step-oci-attach-report", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "provenance": {}, "terminated": { "containerID": "cri-o://945fc85fd1de3deb03ee5c2f6a6c4e9fe7850aa74572c29cd0446ee1aa39bd03", "exitCode": 0, "finishedAt": "2026-05-19T11:43:10Z", "reason": "Completed", "startedAt": "2026-05-19T11:43:07Z" }, "terminationReason": "Completed" }, { "container": "step-conftest-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "conftest-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://8a19238b88c4eab2ac1b5487f1f6bd63f1703a730b02fed623e54f38787c2858", "exitCode": 0, "finishedAt": "2026-05-19T11:43:15Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\\\", \\\"digests\\\": [\\\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e\\\":\\\"sha256:c607a26f33cf8bc3399db9a69cd9598f0ac885ee3f18e7403c36d1251f09c48e\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":48,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:43:15+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:10Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "The platform which will be scanned by this task.", "name": "image-platform", "type": "string" }, { "default": "https://exhort.stage.devshift.net/api/v5/analysis", "description": "The url of the TPA instance which will be used for scanning.", "name": "tpa-url", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-oci-attach-report", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "TPA scan result.", "name": "SCAN_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" }, { "description": "Mapping of image digests to report digests", "name": "REPORTS", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "800m", "memory": "2Gi" }, "requests": { "cpu": "800m", "memory": "2Gi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" }, { "name": "IMAGE_DIGEST", "value": "sha256:232599e8a34a382dd4ae5af37acd3faebdd32846204d49af4b11ea6670b27d9e" }, { "name": "IMAGE_PLATFORM" }, { "name": "TPA_URL", "value": "https://exhort.stage.devshift.net/api/v5/analysis" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "imagePullPolicy": "Always", "name": "get-vulnerabilities", "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n done\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n\ntpa_scan() {\n local sbom_file=${1}\n local arch=${2}\n local sbom_format\n\n sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n local arch=\"$1\"\n local sha_file=\"image-manifest-${arch}.sha\"\n local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n local arch_sha=\"\"\n\n if [ -e \"${sha_file}\" ]; then\n arch_sha=$(\u003c\"${sha_file}\")\n arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n else\n echo \"Couldn't find the SHA file for the requested architecture.\"\n exit 1\n fi\n\n echo \"Selecting auth\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Attempt to download the SBOM file via cosign\n\n if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n echo \"Unable to download SBOM for the architecture ${arch}.\"\n exit 1\n fi\n\n if [ -e \"${sbom_file_path}\" ]; then\n local arch_sha\n arch_sha=$(\u003c\"$sha_file\")\n\n echo \"Running TPA scan on $arch image manifest...\"\n tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n else\n echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n exit 1\n fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n # Validate against supported arch list. If it's not a known arch, fallback to amd64\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 1\n ;;\n esac\n\n run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n for sha_file in image-manifest-*.sha; do\n if [ -e \"$sha_file\" ]; then\n arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n run_tpa_on_arch \"$arch\"\n fi\n done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_OCI_ATTACH_REPORT", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n echo 'OCI attach report skipped by parameter.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n echo 'No TPA reports generated. Skipping upload.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n report_file=\"$1\"\n arch=\"${report_file/*-}\"\n echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n image_ref=\"${repository}@${digest}\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n echo \"Attaching $f to ${image_ref}\"\n if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n then\n echo \"Failed to attach ${f} to ${image_ref}\"\n exit 1\n fi\n # shellcheck disable=SC2016\n reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "conftest-vulnerabilities", "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n if [ ! -s \"$file\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n else\n /usr/bin/conftest test --no-fail $file \\\n --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n fi\n\n #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n result=$(jq -rce \\\n '{\n vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n },\n unpatched_vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n }\n }' \"$file\")\n\n scan_result=$(jq -s -rce \\\n '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/commit_sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cxdclc", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-qrc8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f/records/87ad63f5-c771-4038-9815-f408becb8457", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-076616e8b3b0f008d35512fa77714c3d-32e6ea3b64ba31a8-01\"}" }, "creationTimestamp": "2026-05-19T11:42:00Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRunUID": "176335ee-12e6-4daf-a026-88b9e32b3b8f", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah-oci-ta-min" }, "name": "gl-multi-component-child-ozak-on-push-qrc8h-build-container", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-qrc8h", "uid": "176335ee-12e6-4daf-a026-88b9e32b3b8f" } ], "resourceVersion": "92919", "uid": "87ad63f5-c771-4038-9815-f408becb8457" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "" }, { "name": "COMMIT_SHA", "value": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:53Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:53Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozak-on-push-qrc8h-build-container-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, "entryPoint": "buildah-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min" } }, "results": [ { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "SBOM_BLOB_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:6fcbd5d9d500543c91282301287796692b6ea405bef89209945a941a655a6cc7" } ], "spanContext": { "traceparent": "00-076616e8b3b0f008d35512fa77714c3d-32e6ea3b64ba31a8-01" }, "startTime": "2026-05-19T11:42:00Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://0027784d0eaa39a5152cfee00d5726f74131552dcaee58c50311dd25068f3b81", "exitCode": 0, "finishedAt": "2026-05-19T11:42:06Z", "reason": "Completed", "startedAt": "2026-05-19T11:42:06Z" }, "terminationReason": "Completed" }, { "container": "step-build", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://a71a0cc7da1fc1ba0bcbd4601a2f6e44b39ac9407678b79e113d3fcd7e557e19", "exitCode": 0, "finishedAt": "2026-05-19T11:42:19Z", "reason": "Completed", "startedAt": "2026-05-19T11:42:07Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://bf0fa8b53ea425ccabdaf2934b05fb0b4fd9c10668bd2656e393ca7ac1b0032d", "exitCode": 0, "finishedAt": "2026-05-19T11:42:50Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:42:20Z" }, "terminationReason": "Completed" }, { "container": "step-sbom-syft-generate", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "provenance": {}, "terminated": { "containerID": "cri-o://34a7f2c7ea53b5b1cc9f886457b7e0ec9ceb65a9af9f54d5ee3526e15acaef16", "exitCode": 0, "finishedAt": "2026-05-19T11:43:07Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:42:51Z" }, "terminationReason": "Completed" }, { "container": "step-prepare-sboms", "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "provenance": {}, "terminated": { "containerID": "cri-o://2dc4e04b62a167b6784fce8e721a61b0fa52b94d2cd4e05a41b9a4a799ec6783", "exitCode": 0, "finishedAt": "2026-05-19T11:43:28Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:07Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://8b1e458161da834b49c66275dd393c59ebbb907a6f9aef8aec3550898bfcf0e3", "exitCode": 0, "finishedAt": "2026-05-19T11:43:52Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:6fcbd5d9d500543c91282301287796692b6ea405bef89209945a941a655a6cc7\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:28Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "ACTIVATION_KEY", "value": "activation-key" }, { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "ADD_CAPABILITIES" }, { "name": "ANNOTATIONS_FILE" }, { "name": "BUILD_ARGS_FILE" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXT", "value": "." }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "ENTITLEMENT_SECRET", "value": "etc-pki-entitlement" }, { "name": "HERMETIC", "value": "false" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "IMAGE_EXPIRES_AFTER" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SKIP_INJECTIONS", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "SQUASH", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "TARGET_STAGE" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "--build-args", "--env", "--labels", "--annotations" ], "computeResources": { "limits": { "cpu": "500m", "memory": "1Gi" }, "requests": { "cpu": "500m", "memory": "1Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n fi\n fi\n}\n\nfunction unset_proxy {\n echo \"[$(date --utc -Ins)] Unsetting proxy\"\n unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n # path is valid, do nothing\n ;;\n*)\n echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n echo \"Source path: $source_dir_path\" \u003e\u00262\n echo \"Resolved path: $context_dir_path\" \u003e\u00262\n exit 1\n ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n # Instrumented builds (SAST) use this custom dockerfile step as their base\n dockerfile_path=\"$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n while IFS= read -r line || [[ -n \"$line\" ]]; do\n # Skip empty lines and comments\n if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n ANNOTATIONS+=(\"--annotation\" \"$line\")\n fi\n done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --build-args)\n shift\n # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n build_args+=(\"$1\")\n shift\n done\n ;;\n --env)\n shift\n # Collect env entries of the form KEY=value\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n env_vars+=(\"$1\")\n shift\n done\n ;;\n --labels)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n LABELS+=(\"--label\" \"$1\")\n shift\n done\n ;;\n --annotations)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ANNOTATIONS+=(\"--annotation\" \"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--pull=never\")\n UNSHARE_ARGS+=(\"--net\")\n buildah_retries=3\n\n set_proxy\n\n for image in $BASE_IMAGES; do\n if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n echo \"Failed to pull base image ${image}\"\n exit 1\n fi\n done\n\n unset_proxy\n\n echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n BUILDAH_ARGS+=(\"--cap-add=all\")\n BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n fi\n if [ -n \"$BUILD_TIMESTAMP\" ]; then\n echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n exit 1\n fi\n # but do set it so that we get all the labels/annotations associated with it\n BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n # Identify the current arch to filter the prefetched content\n PREFETCH_ARCH=\"$(uname -m)\"\n echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n echo \"Prefetched content will be made available\"\n\n cp -r \"/var/workdir/cachi2\" /tmp/\n chmod -R go+rwX /tmp/cachi2\n\n # In case RPMs were prefetched and this is a multi-arch build,\n # clean up the packages that do not match the architecture being built\n RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n echo \"Removing prefetched RPMs from non-matching architectures\"\n PREFETCH_ARCH=\"$(uname -m)\"\n for path in \"$RPM_PREFETCH_DIR\"/*; do\n if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n echo \"Removing: $path\"\n rm -rf \"$path\"\n else\n echo \"Keeping: $path\"\n fi\n done\n fi\n\n VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n sed -E -i \\\n -e 'H;1h;$!d;x' \\\n -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n @igM' \\\n \"$dockerfile_copy\"\n\n prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n mkdir -p \"$YUM_REPOS_D_FETCHED\"\n if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n fi\n fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n \"--label\" \"architecture=$(uname -m)\"\n \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n FINAL_BASE_IMAGE=$(\n # Get the base image of the final stage\n # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n # Run the find_root_stage() function on the final stage\n # If the final stage is scratch or oci-archive, return empty\n jq -r '.Stages as $all_stages |\n def find_root_stage($stage):\n if $stage.From.Stage then\n find_root_stage($all_stages[$stage.From.Stage.Index])\n else\n $stage\n end;\n\n find_root_stage(.Stages[-1]) |\n if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n empty\n else\n .BaseName\n end' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n )\n if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n set_proxy\n buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n unset_proxy\n buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n if [[ \"$label\" != \"--label\" ]]; then\n label_pairs+=(\"$label\")\n fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n echo \"\" \u003e\u003e\"$dockerfile_copy\"\n # Always write labels.json to the new standard location\n echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n # Conditionally write to the old location for backward compatibility\n if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n cp \"$containerignore\" \"$ignorefile_copy\"\n {\n echo \"\"\n echo \"!/labels.json\"\n echo \"!/content-sets.json\"\n } \u003e\u003e\"$ignorefile_copy\"\n BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n mkdir -p /shared/rhsm/etc/pki/entitlement\n mkdir -p /shared/rhsm/etc/pki/consumer\n\n VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n echo \"Adding activation key to the build\"\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n echo \"Pre-registering with subscription manager.\"\n export RETRY_MAX_TRIES=6\n if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n echo \"Subscription-manager register failed\"\n exit 1\n fi\n unset RETRY_MAX_TRIES\n trap 'subscription-manager unregister || true' EXIT\n\n # copy generated certificates to /shared volume\n cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n exit 1\n fi\n # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n # (we set the workdir using 'unshare -w')\n context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n # Instrumented builds (SAST) use this step as their base and add some other tools.\n while read -r volume_mount; do\n VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n while read -r filename; do\n echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n buildah build\n \"${VOLUME_MOUNTS[@]}\"\n \"${BUILDAH_ARGS[@]}\"\n \"${LABELS[@]}\"\n \"${ANNOTATIONS[@]}\"\n --tls-verify=\"$TLSVERIFY\" --no-cache\n --ulimit nofile=4096:4096\n --http-proxy=false\n -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n # Get the image pullspec and filter out a tag if it is not set\n # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n # if buildah did not use that particular image during build because it was skipped\n if [ -n \"$base_image_digest\" ]; then\n echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "gl-multi-component-child-ozak-on-push-qrc8h-build-container" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"; then\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n echo -n \"${IMAGE}@\"\n cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e/shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "256m", "memory": "512Mi" }, "requests": { "cpu": "256m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n syft_sbom_type=cyclonedx-json@1.5\n ;;\nspdx)\n syft_sbom_type=spdx-json@2.3\n ;;\n*)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ADDITIONAL_BASE_IMAGES+=(\"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/var/workdir/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "emptyDir": {}, "name": "shared" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/commit_sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cxdclc", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-qrc8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f/records/d5047a0b-f3e0-417e-a18f-2335316df4e0", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-076616e8b3b0f008d35512fa77714c3d-7d900ba24bf4427d-01\"}" }, "creationTimestamp": "2026-05-19T11:43:54Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRunUID": "176335ee-12e6-4daf-a026-88b9e32b3b8f", "tekton.dev/pipelineTask": "build-image-index", "tekton.dev/task": "build-image-index-min" }, "name": "gl-multi-component-child-ozak-on-push-qrc8h-build-image-index", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-qrc8h", "uid": "176335ee-12e6-4daf-a026-88b9e32b3b8f" } ], "resourceVersion": "93715", "uid": "d5047a0b-f3e0-417e-a18f-2335316df4e0" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:03Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:03Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-oz7896df5131d65080e4dbb3bf0aa9a45b-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, "entryPoint": "build-image-index-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min" } }, "results": [ { "name": "IMAGES", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" } ], "spanContext": { "traceparent": "00-076616e8b3b0f008d35512fa77714c3d-7d900ba24bf4427d-01" }, "startTime": "2026-05-19T11:43:54Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://6036b843d9828aa28ed149e3b84288872cce697d4c514cfe8639c7c54f281600", "exitCode": 0, "finishedAt": "2026-05-19T11:44:00Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:58Z" }, "terminationReason": "Completed" }, { "container": "step-create-sbom", "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://1bb5ea9a82ad75b8637e49939b604339e773531fbf40c02308c0f607863cc0e8", "exitCode": 0, "finishedAt": "2026-05-19T11:44:01Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:00Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://a727e45d6b2eb28a6ba91839c711476f48aea12be9e6fbc529ebf3a8a6090629", "exitCode": 0, "finishedAt": "2026-05-19T11:44:03Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:01Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This takes existing Image Manifests and combines them in an Image Index.", "params": [ { "description": "The target image and tag where the image will be pushed to.", "name": "IMAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "description": "List of Image Manifests to be referenced by the Image Index", "name": "IMAGES", "type": "array" }, { "default": "true", "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.", "name": "ALWAYS_BUILD_INDEX", "type": "string" }, { "default": "vfs", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": "false", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "List of all referenced image manifests", "name": "IMAGES", "type": "string" }, { "description": "Image reference of the built image containing both the repository and the digest", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "vfs" } ], "volumeMounts": [ { "mountPath": "/index-build-data", "name": "shared-dir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6@sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n --image \"$IMAGE\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --buildah-format \"$BUILDAH_FORMAT\" \\\n --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n --additional-tags \"gl-multi-component-child-ozak-on-push-qrc8h-build-image-index\" \\\n --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n --result-path-images \"/tekton/results/IMAGES\" \\\n --images \"$@\"; then\n echo \"Failed to build image index\"\n exit 1\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-index\n --index-image-pullspec \"$IMAGE_URL\"\n --index-image-digest \"$IMAGE_DIGEST\"\n --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 } } ], "volumes": [ { "emptyDir": {}, "name": "shared-dir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/commit_sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cxdclc", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-qrc8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f/records/27bcec69-d96e-4bc6-94a2-8ade814b5d86", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-076616e8b3b0f008d35512fa77714c3d-aac4942b6b9a9d55-01\"}" }, "creationTimestamp": "2026-05-19T11:44:03Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRunUID": "176335ee-12e6-4daf-a026-88b9e32b3b8f", "tekton.dev/pipelineTask": "clamav-scan" }, "name": "gl-multi-component-child-ozak-on-push-qrc8h-clamav-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-qrc8h", "uid": "176335ee-12e6-4daf-a026-88b9e32b3b8f" } ], "resourceVersion": "94945", "uid": "27bcec69-d96e-4bc6-94a2-8ade814b5d86" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:45:03Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:45:03Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozak-on-push-qrc8h-clamav-scan-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, "entryPoint": "clamav-scan-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\", \"digests\": [\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779191100\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n" } ], "spanContext": { "traceparent": "00-076616e8b3b0f008d35512fa77714c3d-aac4942b6b9a9d55-01" }, "startTime": "2026-05-19T11:44:03Z", "steps": [ { "container": "step-extract-and-scan-image", "imageID": "quay.io/konflux-ci/clamav-db@sha256:2ee72ac5cda517125824c8139ade1dbf21ee93377e78ece9ef24ec0c55518fe9", "name": "extract-and-scan-image", "provenance": {}, "terminated": { "containerID": "cri-o://195485a6adee64f27074a07e464804dee75fac9878ad1d064977acb36956b86c", "exitCode": 0, "finishedAt": "2026-05-19T11:45:00Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\\\", \\\"digests\\\": [\\\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779191100\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:08Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://d8a55682233ede528f9eb48a6cee37fc08996b616a200c38f7de1ec3ff56d341", "exitCode": 0, "finishedAt": "2026-05-19T11:45:03Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\\\", \\\"digests\\\": [\\\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779191100\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:45:01Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image arch.", "name": "image-arch", "type": "string" }, { "default": "", "description": "unused", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "8", "description": "Maximum number of threads clamd runs.", "name": "clamd-max-threads", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-upload", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "512m", "memory": "3Gi" }, "requests": { "cpu": "512m", "memory": "3Gi" } }, "env": [ { "name": "HOME", "value": "/work" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "IMAGE_DIGEST", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "IMAGE_ARCH" }, { "name": "MAX_THREADS", "value": "8" } ], "image": "quay.io/konflux-ci/clamav-db:latest", "name": "extract-and-scan-image", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n mkdir -p ~/.docker\n echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n# $1: destination - path to the content to scan\n# $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n# $3: digest - digest to add to digests_processed array\n# $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n local destination=\"$1\"\n local suffix=\"$2\"\n local digest=\"$3\"\n local scan_message=\"${4:-Scanning content}\"\n\n db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n echo \"$scan_message. This operation may take a while.\"\n clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n digests_processed+=(\"\\\"$digest\\\"\")\n\n if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n # OPA/EC requires structured data input, add clamAV log into json\n jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o json \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o appstudio \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n\n if [ -n \"$raw_manifest\" ]; then\n media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n # Determine if this is an OCI artifact (not a container image)\n # OCI artifacts typically have:\n # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n # - An explicit artifactType field that is not a container image type\n is_oci_artifact=false\n\n # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n is_oci_artifact=true\n fi\n\n # Check if artifactType is set and is not a container image type\n if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n is_oci_artifact=true\n fi\n\n if [ \"$is_oci_artifact\" = true ]; then\n # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n # This looks like a container image manifest, but get_image_manifests failed\n echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n else\n # Likely an OCI artifact with non-standard media type\n echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n fi\n else\n echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n echo \"Detected container image. Processing image manifests.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n # Proceed only if a specific arch is provided.\n # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n if [ -n \"$IMAGE_ARCH\" ]; then\n arch=\"${IMAGE_ARCH#*/}\"\n if [ \"${arch}\" = \"x86_64\" ]; then\n arch=\"amd64\"\n fi\n\n # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n arch=\"amd64\"\n ;;\n esac\n\n image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n fi\n\n while read -r arch arch_sha; do\n destination=\"content-${arch}\"\n mkdir -p \"$destination\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n exit 0\n fi\n\n # Scan and process container image for this architecture\n scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n {\n \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n \"namespace\" : $item.namespace,\n \"successes\" : (.successes + $item.successes),\n \"failures\" : (.failures + $item.failures),\n \"warnings\" : (.warnings + $item.warnings),\n \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_UPLOAD", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "IMAGE_DIGEST", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n echo \"Upload skipped by parameter.\"\n exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n MEDIA_TYPE=text/vnd.clamav\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n MEDIA_TYPE=application/vnd.konflux.test_output+json\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n echo \"No files found. Skipping upload.\"\n exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n", "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" } ], "volumes": [ { "emptyDir": {}, "name": "dbfolder" }, { "emptyDir": {}, "name": "work" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/commit_sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cxdclc", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-qrc8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f/records/bed55ebc-6fd4-40b8-b8ca-9fad2dad63b2", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone oci trusted artifacts", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-076616e8b3b0f008d35512fa77714c3d-692c3351f016ef4c-01\"}" }, "creationTimestamp": "2026-05-19T11:41:11Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRunUID": "176335ee-12e6-4daf-a026-88b9e32b3b8f", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone-oci-ta-min" }, "name": "gl-multi-component-child-ozak-on-push-qrc8h-clone-repository", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-qrc8h", "uid": "176335ee-12e6-4daf-a026-88b9e32b3b8f" } ], "resourceVersion": "89308", "uid": "bed55ebc-6fd4-40b8-b8ca-9fad2dad63b2" }, "spec": { "params": [ { "name": "url", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "revision", "value": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6.git" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "basic-auth", "secret": { "secretName": "pac-gitauth-cxdclc" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:41:20Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:41:20Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-oz5be7f91e519019a98cbeb5ead139e8a9-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, "entryPoint": "git-clone-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "commit", "type": "string", "value": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "commit-timestamp", "type": "string", "value": "1779190857" }, { "name": "short-commit", "type": "string", "value": "dceb969" }, { "name": "url", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591" } ], "spanContext": { "traceparent": "00-076616e8b3b0f008d35512fa77714c3d-692c3351f016ef4c-01" }, "startTime": "2026-05-19T11:41:11Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "provenance": {}, "terminated": { "containerID": "cri-o://7b76ea4759c591202f94512d86d75e2c8e58dbd383e2e613ed8cccfdae357113", "exitCode": 0, "finishedAt": "2026-05-19T11:41:18Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190857\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"dceb969\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:17Z" }, "terminationReason": "Completed" }, { "container": "step-symlink-check", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "provenance": {}, "terminated": { "containerID": "cri-o://5eee60d080bc2833eaf80b0c30c549c7bc109a74090910f92057e57f3a334863", "exitCode": 0, "finishedAt": "2026-05-19T11:41:18Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190857\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"dceb969\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:18Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://0c54900a3817770f184e9b3b8d4b262a6f45db1196df723f1e51cabdbad778b9", "exitCode": 0, "finishedAt": "2026-05-19T11:41:19Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591\",\"type\":1},{\"key\":\"commit\",\"value\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190857\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"dceb969\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:18Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.", "params": [ { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "7", "description": "Length of short commit SHA", "name": "shortCommitLength", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n", "name": "submodulePaths", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "/tekton/home", "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n", "name": "userHome", "type": "string" }, { "default": "false", "description": "Log the commands that are executed during `git-clone`'s operation.", "name": "verbose", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" }, { "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" } ], "steps": [ { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "PARAM_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn" }, { "name": "PARAM_REVISION", "value": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "PARAM_REFSPEC" }, { "name": "PARAM_SUBMODULES", "value": "true" }, { "name": "PARAM_SUBMODULE_PATHS" }, { "name": "PARAM_DEPTH", "value": "1" }, { "name": "PARAM_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "PARAM_SSL_VERIFY", "value": "true" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "PARAM_VERBOSE", "value": "false" }, { "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "PARAM_USER_HOME", "value": "/tekton/home" }, { "name": "PARAM_FETCH_TAGS", "value": "false" }, { "name": "PARAM_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "PARAM_TARGET_BRANCH", "value": "main" }, { "name": "PARAM_MERGE_SOURCE_REPO_URL" }, { "name": "PARAM_MERGE_SOURCE_DEPTH" }, { "name": "WORKSPACE_SSH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_SSH_DIRECTORY_PATH" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND", "value": "true" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH", "value": "/workspace/basic-auth" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n # Compatibility with kubernetes.io/basic-auth secrets\n elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n else\n echo \"Unknown basic-auth workspace format\"\n exit 1\n fi\n chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n -url=\"${PARAM_URL}\" \\\n -revision=\"${PARAM_REVISION}\" \\\n -refspec=\"${PARAM_REFSPEC}\" \\\n -path=\"${CHECKOUT_DIR}\" \\\n -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n -submodules=\"${PARAM_SUBMODULES}\" \\\n -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n -depth=\"${PARAM_DEPTH}\" \\\n -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n # Determine if merging from a different repository or the same one\n if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n normalize_url() {\n echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n }\n\n NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n MERGE_REMOTE=\"origin\"\n else\n echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n echo \"Adding remote 'merge-source'...\"\n git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n MERGE_REMOTE=\"merge-source\"\n fi\n else\n echo \"Merging from the same repository (origin)\"\n MERGE_REMOTE=\"origin\"\n fi\n\n echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n else\n retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n fi\n\n echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n git config --global user.email \"tekton-git-clone@tekton.dev\"\n git config --global user.name \"Tekton Git Clone Task\"\n\n if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n echo \"--- Git Status ---\"\n git status\n echo \"------------------\"\n exit 1\n fi\n\n # Check if there are changes staged for commit\n if git diff --staged --quiet; then\n echo \"No diff was found, skipping merge...\" \u003e\u00262\n else\n echo \"Merge successful (no conflicts found), committing...\"\n if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n exit 1\n fi\n MERGED_SHA=$(git rev-parse HEAD)\n echo \"New HEAD after merge: ${MERGED_SHA}\"\n echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n fi\n\nelse\n echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n echo \"Fetching tags\"\n retry git fetch --tags\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "computeResources": {}, "env": [ { "name": "PARAM_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n while read -r symlink; do\n target=$(readlink -m \"$symlink\")\n if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n fi\n done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n return 1\n fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n echo \"Running symlink check\"\n check_symlinks\nfi\n", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6.git", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/commit_sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cxdclc", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-qrc8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f/records/b1377dc3-0882-4ddc-9b2c-94ceeb83886f", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-076616e8b3b0f008d35512fa77714c3d-6c8cf8f87d87c211-01\"}" }, "creationTimestamp": "2026-05-19T11:41:06Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRunUID": "176335ee-12e6-4daf-a026-88b9e32b3b8f", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init" }, "name": "gl-multi-component-child-ozak-on-push-qrc8h-init", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-qrc8h", "uid": "176335ee-12e6-4daf-a026-88b9e32b3b8f" } ], "resourceVersion": "89057", "uid": "b1377dc3-0882-4ddc-9b2c-94ceeb83886f" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:41:11Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:41:11Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozak-on-push-qrc8h-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "spanContext": { "traceparent": "00-076616e8b3b0f008d35512fa77714c3d-6c8cf8f87d87c211-01" }, "startTime": "2026-05-19T11:41:06Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "init", "provenance": {}, "terminated": { "containerID": "cri-o://55849d52cd81ca4cb9965d5ec98430f9d270434174bc5440b275fe6a52a5320b", "exitCode": 0, "finishedAt": "2026-05-19T11:41:10Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:10Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/commit_sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cxdclc", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-qrc8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f/records/46d9f0e9-a05b-41f5-87bc-f7def6362b7c", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-076616e8b3b0f008d35512fa77714c3d-1b9e5f6c60355033-01\"}" }, "creationTimestamp": "2026-05-19T11:44:03Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRunUID": "176335ee-12e6-4daf-a026-88b9e32b3b8f", "tekton.dev/pipelineTask": "rpms-signature-scan", "tekton.dev/task": "rpms-signature-scan" }, "name": "gl-multi-component-child-ozak-on-push-qrc8h-rpms-signature-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-qrc8h", "uid": "176335ee-12e6-4daf-a026-88b9e32b3b8f" } ], "resourceVersion": "94051", "uid": "46d9f0e9-a05b-41f5-87bc-f7def6362b7c" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "image-digest", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:20Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:20Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-oz0299981d61268d1498f7223c4552c8ac-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, "entryPoint": "rpms-signature-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\", \"digests\": [\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\"]}}\n" }, { "name": "RPMS_DATA", "type": "string", "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:44:18+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-076616e8b3b0f008d35512fa77714c3d-1b9e5f6c60355033-01" }, "startTime": "2026-05-19T11:44:03Z", "steps": [ { "container": "step-rpms-signature-scan", "imageID": "quay.io/konflux-ci/tools@sha256:0d2fbb45b33949aa7474157b7cae3a55d3a399405fd8bef75dd73d0bee96890a", "name": "rpms-signature-scan", "provenance": {}, "terminated": { "containerID": "cri-o://7f40566b45db508cae639966133a4e998e7869d1e11aca1050538ee84d0e98b7", "exitCode": 0, "finishedAt": "2026-05-19T11:44:17Z", "reason": "Completed", "startedAt": "2026-05-19T11:44:10Z" }, "terminationReason": "Completed" }, { "container": "step-output-results", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "provenance": {}, "terminated": { "containerID": "cri-o://989608847c1eb838003fc24e3693a6a5ab44430664741a5f39ac52a9672eea79", "exitCode": 0, "finishedAt": "2026-05-19T11:44:19Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\\\", \\\"digests\\\": [\\\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:18+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:18Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans RPMs in an image and provide information about RPMs signatures.", "params": [ { "description": "Image URL", "name": "image-url", "type": "string" }, { "description": "Image digest to scan", "name": "image-digest", "type": "string" }, { "default": "/tmp", "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n", "name": "workdir", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Information about signed and unsigned RPMs", "name": "RPMS_DATA", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "200m", "memory": "256Mi" }, "requests": { "cpu": "200m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "IMAGE_DIGEST", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/tools@sha256:cdab2b0f6e01ed7852ad4c5376fd58bdbfe0db1379dd5acf42aad722a0f1e168", "name": "rpms-signature-scan", "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n --image-url \"${IMAGE_URL}\" \\\n --image-digest \"${IMAGE_DIGEST}\" \\\n --workdir \"${WORKDIR}\" \\\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "50m", "memory": "32Mi" }, "requests": { "cpu": "50m", "memory": "32Mi" } }, "env": [ { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/commit_sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cxdclc", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-qrc8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f/records/dc2def7a-7362-4fa1-b31b-2fb9ef8470c6", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-076616e8b3b0f008d35512fa77714c3d-25e3b0a695d1f496-01\"}" }, "creationTimestamp": "2026-05-19T11:44:03Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRunUID": "176335ee-12e6-4daf-a026-88b9e32b3b8f", "tekton.dev/pipelineTask": "sast-shell-check", "tekton.dev/task": "sast-shell-check-oci-ta-min" }, "name": "gl-multi-component-child-ozak-on-push-qrc8h-sast-shell-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-qrc8h", "uid": "176335ee-12e6-4daf-a026-88b9e32b3b8f" } ], "resourceVersion": "94098", "uid": "dc2def7a-7362-4fa1-b31b-2fb9ef8470c6" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-shell-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:23Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:23Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-oz5f4dbaf1e80c345aaabe6397043e3e76-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, "entryPoint": "sast-shell-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:44:20+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-076616e8b3b0f008d35512fa77714c3d-25e3b0a695d1f496-01" }, "startTime": "2026-05-19T11:44:03Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://9d8d1bf4dd076686f4feb76c4f61bd51a0e0cc90204eed5966b1cf7337d70911", "exitCode": 0, "finishedAt": "2026-05-19T11:44:10Z", "reason": "Completed", "startedAt": "2026-05-19T11:44:10Z" }, "terminationReason": "Completed" }, { "container": "step-sast-shell-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-shell-check", "provenance": {}, "terminated": { "containerID": "cri-o://043c585186a9cf49a4e106d1c3b7684bf8c93b6ebd9455f6edd729b613a11dad", "exitCode": 0, "finishedAt": "2026-05-19T11:44:21Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:20+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:11Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://49d81857448caed40a37fa19ad8567b0bb88f1d36e538832e9d3d6283fc20e85", "exitCode": 0, "finishedAt": "2026-05-19T11:44:22Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:20+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:21Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "true", "description": "Whether to include important findings only", "name": "IMP_FINDINGS_ONLY", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Image digest to report findings for.", "name": "image-digest", "type": "string" }, { "default": "", "description": "Image URL.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "128m", "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "IMP_FINDINGS_ONLY", "value": "true" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-shell-check", "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n resolved_path=$(realpath -m \"$potential_path\")\n\n # ensure resolved path is still within SOURCE_CODE_DIR\n if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n ALL_TARGETS+=(\"$resolved_path\")\n else\n echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n exit 1\n fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n read -r quota period \u003c/sys/fs/cgroup/cpu.max\n if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n export SC_JOBS=$(((quota + period - 1) / period))\n echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n --mode=json\n --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n # predefined list of shellcheck important findings\n CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n CSGREP_OPTS+=(\n --event=\"$CSGREP_EVENT_FILTER\"\n )\nelse\n CSGREP_OPTS+=(\n --event=\"error|warning\"\n )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n echo \"Error occurred while running 'run-shellcheck.sh'\"\n note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n else\n mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "IMAGE_DIGEST", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n echo 'No image-url or image-digest param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n # Determine the media type based on the file extension\n if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n MEDIA_TYPE=\"application/json\"\n else\n MEDIA_TYPE=\"application/sarif+json\"\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n exit 1\n fi\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/commit_sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cxdclc", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-qrc8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f/records/46c8b2a4-6b75-4d27-83d1-2097e34b17f9", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-076616e8b3b0f008d35512fa77714c3d-b6a083f2d82114ee-01\"}" }, "creationTimestamp": "2026-05-19T11:44:03Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRunUID": "176335ee-12e6-4daf-a026-88b9e32b3b8f", "tekton.dev/pipelineTask": "sast-unicode-check", "tekton.dev/task": "sast-unicode-check-oci-ta-min" }, "name": "gl-multi-component-child-ozak-on-push-qrc8h-sast-unicode-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-qrc8h", "uid": "176335ee-12e6-4daf-a026-88b9e32b3b8f" } ], "resourceVersion": "93876", "uid": "46c8b2a4-6b75-4d27-83d1-2097e34b17f9" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:14Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:14Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozdc6b7e1e339d4a414c99db11331ad7e6-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, "entryPoint": "sast-unicode-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:44:12+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-076616e8b3b0f008d35512fa77714c3d-b6a083f2d82114ee-01" }, "startTime": "2026-05-19T11:44:03Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://4e59f226bdfd29734d429f195f733a7cfe654b927c08c1a8c7b8fb0dd366d9d6", "exitCode": 0, "finishedAt": "2026-05-19T11:44:10Z", "reason": "Completed", "startedAt": "2026-05-19T11:44:10Z" }, "terminationReason": "Completed" }, { "container": "step-sast-unicode-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-unicode-check", "provenance": {}, "terminated": { "containerID": "cri-o://1ac1d22fadf71a8061ae1e4077cc058f3b6bb14e042b1f4e631ceede38f67f4d", "exitCode": 0, "finishedAt": "2026-05-19T11:44:12Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:12+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:11Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://61381a712f916a8a069868d203b7534a918fcdc14d4786f3c97f7303cec3c17b", "exitCode": 0, "finishedAt": "2026-05-19T11:44:13Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:12+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:12Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans source code for non-printable unicode characters in all text files.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "-p bidi -v -d -t", "description": "arguments for find-unicode-control command.", "name": "FIND_UNICODE_CONTROL_ARGS", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "description": "Image digest used for ORAS upload.", "name": "image-digest", "type": "string" }, { "description": "Image URL used for ORAS upload.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:4ea8df66cfac3ff165b9d006a0afb5d279d63841b22e65162008c20500924591=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "FIND_UNICODE_CONTROL_ARGS", "value": "-p bidi -v -d -t" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_CODE_DIR", "value": "/var/workdir" }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-unicode-check", "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n \u003eraw_sast_unicode_check_out.txt \\\n 2\u003eraw_sast_unicode_check_out.log ||\n FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n echo \"Failed to run find-unicode-control command\" \u003e\u00262\n cat raw_sast_unicode_check_out.log\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n --mode=json\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"${SCAN_PROP}\"\n --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n cat processed_sast_unicode_check_out.err\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # Build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n # Append --record-excluded option if RECORD_EXCLUDED is true\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n else\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n echo \"sast-unicode-check test failed because of the following issues:\"\n cat sast_unicode_check_out.json\n TEST_OUTPUT=\n parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "IMAGE_DIGEST", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n echo 'No image-url param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n MEDIA_TYPE=application/json\n else\n MEDIA_TYPE=application/sarif+json\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/commit_sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cxdclc", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-qrc8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f/records/62732e32-d626-4aa7-b4f7-1cb7cce00b88", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"dceb96997bd3f1f082a8466d6c05840d66aeb0c6\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/176335ee-12e6-4daf-a026-88b9e32b3b8f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-076616e8b3b0f008d35512fa77714c3d-b031fd86a21cc99f-01\"}" }, "creationTimestamp": "2026-05-19T11:44:03Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "dceb96997bd3f1f082a8466d6c05840d66aeb0c6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-qrc8h", "tekton.dev/pipelineRunUID": "176335ee-12e6-4daf-a026-88b9e32b3b8f", "tekton.dev/pipelineTask": "tpa-scan", "tekton.dev/task": "tpa-scan" }, "name": "gl-multi-component-child-ozak-on-push-qrc8h-tpa-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-qrc8h", "uid": "176335ee-12e6-4daf-a026-88b9e32b3b8f" } ], "resourceVersion": "94028", "uid": "62732e32-d626-4aa7-b4f7-1cb7cce00b88" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "tpa-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:18Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:18Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-child-ozak-on-push-qrc8h-tpa-scan-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, "entryPoint": "tpa-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\", \"digests\": [\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\"]}}\n" }, { "name": "REPORTS", "type": "string", "value": "{\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\":\"sha256:e048c5d517e488bc94bdbc36a4a67441ba07e6b273f24c6a30d03e3426b40e5d\"}\n" }, { "name": "SCAN_OUTPUT", "type": "string", "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":48,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:44:18+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-076616e8b3b0f008d35512fa77714c3d-b031fd86a21cc99f-01" }, "startTime": "2026-05-19T11:44:03Z", "steps": [ { "container": "step-get-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "get-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://26c254a9a04b0a640681214e49ccdbcf766cc710c38ee3d9f5b0117006948cd9", "exitCode": 0, "finishedAt": "2026-05-19T11:44:10Z", "reason": "Completed", "startedAt": "2026-05-19T11:44:09Z" }, "terminationReason": "Completed" }, { "container": "step-oci-attach-report", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "provenance": {}, "terminated": { "containerID": "cri-o://9d18330e0afa60d4618addd4a2a78226ecdb646a1bc1d99c199b6f8072c381a3", "exitCode": 0, "finishedAt": "2026-05-19T11:44:13Z", "reason": "Completed", "startedAt": "2026-05-19T11:44:11Z" }, "terminationReason": "Completed" }, { "container": "step-conftest-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "conftest-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://21d2239a63a311085bdc65ef2112ae7c07ac5df61f941091b335a8f8cddd9b25", "exitCode": 0, "finishedAt": "2026-05-19T11:44:18Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6\\\", \\\"digests\\\": [\\\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d\\\":\\\"sha256:e048c5d517e488bc94bdbc36a4a67441ba07e6b273f24c6a30d03e3426b40e5d\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":48,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:18+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:14Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "The platform which will be scanned by this task.", "name": "image-platform", "type": "string" }, { "default": "https://exhort.stage.devshift.net/api/v5/analysis", "description": "The url of the TPA instance which will be used for scanning.", "name": "tpa-url", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-oci-attach-report", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "TPA scan result.", "name": "SCAN_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" }, { "description": "Mapping of image digests to report digests", "name": "REPORTS", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "800m", "memory": "2Gi" }, "requests": { "cpu": "800m", "memory": "2Gi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" }, { "name": "IMAGE_DIGEST", "value": "sha256:d9eecdd802ce6a3cd8ee98a79b53dd7a27a66bddef6e9db0773e22e76683e50d" }, { "name": "IMAGE_PLATFORM" }, { "name": "TPA_URL", "value": "https://exhort.stage.devshift.net/api/v5/analysis" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "imagePullPolicy": "Always", "name": "get-vulnerabilities", "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n done\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n\ntpa_scan() {\n local sbom_file=${1}\n local arch=${2}\n local sbom_format\n\n sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n local arch=\"$1\"\n local sha_file=\"image-manifest-${arch}.sha\"\n local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n local arch_sha=\"\"\n\n if [ -e \"${sha_file}\" ]; then\n arch_sha=$(\u003c\"${sha_file}\")\n arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n else\n echo \"Couldn't find the SHA file for the requested architecture.\"\n exit 1\n fi\n\n echo \"Selecting auth\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Attempt to download the SBOM file via cosign\n\n if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n echo \"Unable to download SBOM for the architecture ${arch}.\"\n exit 1\n fi\n\n if [ -e \"${sbom_file_path}\" ]; then\n local arch_sha\n arch_sha=$(\u003c\"$sha_file\")\n\n echo \"Running TPA scan on $arch image manifest...\"\n tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n else\n echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n exit 1\n fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n # Validate against supported arch list. If it's not a known arch, fallback to amd64\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 1\n ;;\n esac\n\n run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n for sha_file in image-manifest-*.sha; do\n if [ -e \"$sha_file\" ]; then\n arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n run_tpa_on_arch \"$arch\"\n fi\n done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_OCI_ATTACH_REPORT", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:dceb96997bd3f1f082a8466d6c05840d66aeb0c6" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n echo 'OCI attach report skipped by parameter.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n echo 'No TPA reports generated. Skipping upload.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n report_file=\"$1\"\n arch=\"${report_file/*-}\"\n echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n image_ref=\"${repository}@${digest}\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n echo \"Attaching $f to ${image_ref}\"\n if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n then\n echo \"Failed to attach ${f} to ${image_ref}\"\n exit 1\n fi\n # shellcheck disable=SC2016\n reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "conftest-vulnerabilities", "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n if [ ! -s \"$file\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n else\n /usr/bin/conftest test --no-fail $file \\\n --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n fi\n\n #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n result=$(jq -rce \\\n '{\n vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n },\n unpatched_vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n }\n }' \"$file\")\n\n scan_result=$(jq -s -rce \\\n '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/commit_sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-efgczi", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537079501", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-pull-request-p8f29", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de/records/86c9c234-9209-41a8-9792-9af534446f3b", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-660eee8a28dcd3f4219f7b9a24544a26-7f536d6b1a7ff0a3-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-ozak" }, "creationTimestamp": "2026-05-19T11:30:18Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRunUID": "f15699a7-890e-44ed-894d-e491f912d6de", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init", "test.appstudio.openshift.io/pr-group-sha": "529787a3d31011e383e7ca8b1425806842b93c02ed7a11d2dfaa720615f604" }, "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29-init", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "uid": "f15699a7-890e-44ed-894d-e491f912d6de" } ], "resourceVersion": "72077", "uid": "86c9c234-9209-41a8-9792-9af534446f3b" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:30:23Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:30:23Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-parent-ozak-on-pull-request-p8f29-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "spanContext": { "traceparent": "00-660eee8a28dcd3f4219f7b9a24544a26-7f536d6b1a7ff0a3-01" }, "startTime": "2026-05-19T11:30:18Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "init", "provenance": {}, "terminated": { "containerID": "cri-o://85f6bec851b4e4df70ea88f5945a9816bf15e623a5d7f5e8843a9d4f78c3d8ee", "exitCode": 0, "finishedAt": "2026-05-19T11:30:22Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:30:22Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/commit_sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "build.appstudio.redhat.com/pull_request_number": "1", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-efgczi", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537079501", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-pull-request-p8f29", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de/records/6d134c50-9c5d-47d5-8edb-20a7a16ad80b", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"df6fab6553b5fc7c7860573d647770674b8e38fc\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}", "results.tekton.dev/result": "build-e2e-xudt/results/f15699a7-890e-44ed-894d-e491f912d6de", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-660eee8a28dcd3f4219f7b9a24544a26-7fc087938de13880-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-ozak" }, "creationTimestamp": "2026-05-19T11:34:12Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "1", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "df6fab6553b5fc7c7860573d647770674b8e38fc", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "tekton.dev/pipelineRunUID": "f15699a7-890e-44ed-894d-e491f912d6de", "tekton.dev/pipelineTask": "tpa-scan", "tekton.dev/task": "tpa-scan", "test.appstudio.openshift.io/pr-group-sha": "529787a3d31011e383e7ca8b1425806842b93c02ed7a11d2dfaa720615f604" }, "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29-tpa-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-pull-request-p8f29", "uid": "f15699a7-890e-44ed-894d-e491f912d6de" } ], "resourceVersion": "79234", "uid": "6d134c50-9c5d-47d5-8edb-20a7a16ad80b" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "tpa-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:24Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:24Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-parent-o7f122cef58b509d687bf958bf3a235b8-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, "entryPoint": "tpa-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\", \"digests\": [\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\"]}}\n" }, { "name": "REPORTS", "type": "string", "value": "{\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\":\"sha256:8eb9dc2ec57e668f354177695e6713c5eb7caa0d77d4211c7ff23b47df03a775\"}\n" }, { "name": "SCAN_OUTPUT", "type": "string", "value": "{\"vulnerabilities\":{\"critical\":4,\"high\":30,\"medium\":53,\"low\":9,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:34:24+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-660eee8a28dcd3f4219f7b9a24544a26-7fc087938de13880-01" }, "startTime": "2026-05-19T11:34:12Z", "steps": [ { "container": "step-get-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "get-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://4b42a6c2c8dd78b08581dbe8b9b50d76082937c7b3d65f61554f122847fa2120", "exitCode": 0, "finishedAt": "2026-05-19T11:34:19Z", "reason": "Completed", "startedAt": "2026-05-19T11:34:17Z" }, "terminationReason": "Completed" }, { "container": "step-oci-attach-report", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "provenance": {}, "terminated": { "containerID": "cri-o://eb0d997225cf8da20350e1a594abcfb153233938ae7c08db233212949c15fde9", "exitCode": 0, "finishedAt": "2026-05-19T11:34:22Z", "reason": "Completed", "startedAt": "2026-05-19T11:34:19Z" }, "terminationReason": "Completed" }, { "container": "step-conftest-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "conftest-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://dfaf1f4d0119b71e9250fe3d16bee34e571cdf7763b60d0d8dc7a04c8b5b92c3", "exitCode": 0, "finishedAt": "2026-05-19T11:34:24Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc\\\", \\\"digests\\\": [\\\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1\\\":\\\"sha256:8eb9dc2ec57e668f354177695e6713c5eb7caa0d77d4211c7ff23b47df03a775\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":4,\\\"high\\\":30,\\\"medium\\\":53,\\\"low\\\":9,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:24+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:22Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "The platform which will be scanned by this task.", "name": "image-platform", "type": "string" }, { "default": "https://exhort.stage.devshift.net/api/v5/analysis", "description": "The url of the TPA instance which will be used for scanning.", "name": "tpa-url", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-oci-attach-report", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "TPA scan result.", "name": "SCAN_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" }, { "description": "Mapping of image digests to report digests", "name": "REPORTS", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "800m", "memory": "2Gi" }, "requests": { "cpu": "800m", "memory": "2Gi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" }, { "name": "IMAGE_DIGEST", "value": "sha256:805e332e00a6b4e1d75390a6471893bd806a56c88fb0c9ad5b606403251ef2d1" }, { "name": "IMAGE_PLATFORM" }, { "name": "TPA_URL", "value": "https://exhort.stage.devshift.net/api/v5/analysis" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "imagePullPolicy": "Always", "name": "get-vulnerabilities", "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n done\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n\ntpa_scan() {\n local sbom_file=${1}\n local arch=${2}\n local sbom_format\n\n sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n local arch=\"$1\"\n local sha_file=\"image-manifest-${arch}.sha\"\n local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n local arch_sha=\"\"\n\n if [ -e \"${sha_file}\" ]; then\n arch_sha=$(\u003c\"${sha_file}\")\n arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n else\n echo \"Couldn't find the SHA file for the requested architecture.\"\n exit 1\n fi\n\n echo \"Selecting auth\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Attempt to download the SBOM file via cosign\n\n if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n echo \"Unable to download SBOM for the architecture ${arch}.\"\n exit 1\n fi\n\n if [ -e \"${sbom_file_path}\" ]; then\n local arch_sha\n arch_sha=$(\u003c\"$sha_file\")\n\n echo \"Running TPA scan on $arch image manifest...\"\n tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n else\n echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n exit 1\n fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n # Validate against supported arch list. If it's not a known arch, fallback to amd64\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 1\n ;;\n esac\n\n run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n for sha_file in image-manifest-*.sha; do\n if [ -e \"$sha_file\" ]; then\n arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n run_tpa_on_arch \"$arch\"\n fi\n done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_OCI_ATTACH_REPORT", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:on-pr-df6fab6553b5fc7c7860573d647770674b8e38fc" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n echo 'OCI attach report skipped by parameter.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n echo 'No TPA reports generated. Skipping upload.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n report_file=\"$1\"\n arch=\"${report_file/*-}\"\n echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n image_ref=\"${repository}@${digest}\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n echo \"Attaching $f to ${image_ref}\"\n if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n then\n echo \"Failed to attach ${f} to ${image_ref}\"\n exit 1\n fi\n # shellcheck disable=SC2016\n reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "conftest-vulnerabilities", "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n if [ ! -s \"$file\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n else\n /usr/bin/conftest test --no-fail $file \\\n --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n fi\n\n #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n result=$(jq -rce \\\n '{\n vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n },\n unpatched_vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n }\n }' \"$file\")\n\n scan_result=$(jq -s -rce \\\n '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/commit_sha": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-rbxbrr", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111804", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-push-r8tjg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-ozak' into 'multi-component-parent-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f/records/def37508-2f0c-458f-838f-c5c91fa72b44", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"1635086a67b70da955b6ec55379eba702eded716\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-2478d72c89567a3a5a71a1aa38c4ecde-a357bfa04c1657b0-01\"}" }, "creationTimestamp": "2026-05-19T11:42:01Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRunUID": "308865f3-3843-4928-bc02-8eebfe5b4c5f", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah-oci-ta-min" }, "name": "gl-multi-component-parent-ozak-on-push-r8tjg-build-container", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-push-r8tjg", "uid": "308865f3-3843-4928-bc02-8eebfe5b4c5f" } ], "resourceVersion": "92781", "uid": "def37508-2f0c-458f-838f-c5c91fa72b44" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "" }, { "name": "COMMIT_SHA", "value": "1635086a67b70da955b6ec55379eba702eded716" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:49Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:49Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-parent-o5bcf7729791a065d11eb3253390fe9c3-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, "entryPoint": "buildah-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min" } }, "results": [ { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "SBOM_BLOB_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:4bde8b1740cc89fa245ca6a255477e1d23f93397e99a54901700aeef967f8264" } ], "spanContext": { "traceparent": "00-2478d72c89567a3a5a71a1aa38c4ecde-a357bfa04c1657b0-01" }, "startTime": "2026-05-19T11:42:02Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://068ae025d9358682e630c15f946b1d162e5c19814f1963cb7b2286db9c900ab9", "exitCode": 0, "finishedAt": "2026-05-19T11:42:07Z", "reason": "Completed", "startedAt": "2026-05-19T11:42:06Z" }, "terminationReason": "Completed" }, { "container": "step-build", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://84675d4dfdb7921aee4b661561073ad95140bba49edbd2140640886066595f68", "exitCode": 0, "finishedAt": "2026-05-19T11:42:21Z", "reason": "Completed", "startedAt": "2026-05-19T11:42:07Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://554ff60ec0cd5ea44900eec47105cc8da1ca362ddd1b61910b602f57ed93c59e", "exitCode": 0, "finishedAt": "2026-05-19T11:42:51Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:42:22Z" }, "terminationReason": "Completed" }, { "container": "step-sbom-syft-generate", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "provenance": {}, "terminated": { "containerID": "cri-o://eca582521e8c6bdc6a894b9cbe31a08ceda387a9ffc634eecee24dec90a0f568", "exitCode": 0, "finishedAt": "2026-05-19T11:43:07Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:42:52Z" }, "terminationReason": "Completed" }, { "container": "step-prepare-sboms", "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "provenance": {}, "terminated": { "containerID": "cri-o://9aa1ab2ce4dd59c0db370c8ede86d9193c462b11d724bf499a97e8874817976e", "exitCode": 0, "finishedAt": "2026-05-19T11:43:25Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:08Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://67d2c0cd73e5474121329b37462ab82e9f00fe1b83bac2e2a635e9cf7995e28d", "exitCode": 0, "finishedAt": "2026-05-19T11:43:48Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:4bde8b1740cc89fa245ca6a255477e1d23f93397e99a54901700aeef967f8264\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:25Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "ACTIVATION_KEY", "value": "activation-key" }, { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "ADD_CAPABILITIES" }, { "name": "ANNOTATIONS_FILE" }, { "name": "BUILD_ARGS_FILE" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXT", "value": "." }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "ENTITLEMENT_SECRET", "value": "etc-pki-entitlement" }, { "name": "HERMETIC", "value": "false" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "IMAGE_EXPIRES_AFTER" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SKIP_INJECTIONS", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "SQUASH", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "TARGET_STAGE" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "--build-args", "--env", "--labels", "--annotations" ], "computeResources": { "limits": { "cpu": "500m", "memory": "1Gi" }, "requests": { "cpu": "500m", "memory": "1Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "1635086a67b70da955b6ec55379eba702eded716" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n fi\n fi\n}\n\nfunction unset_proxy {\n echo \"[$(date --utc -Ins)] Unsetting proxy\"\n unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n # path is valid, do nothing\n ;;\n*)\n echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n echo \"Source path: $source_dir_path\" \u003e\u00262\n echo \"Resolved path: $context_dir_path\" \u003e\u00262\n exit 1\n ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n # Instrumented builds (SAST) use this custom dockerfile step as their base\n dockerfile_path=\"$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n while IFS= read -r line || [[ -n \"$line\" ]]; do\n # Skip empty lines and comments\n if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n ANNOTATIONS+=(\"--annotation\" \"$line\")\n fi\n done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --build-args)\n shift\n # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n build_args+=(\"$1\")\n shift\n done\n ;;\n --env)\n shift\n # Collect env entries of the form KEY=value\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n env_vars+=(\"$1\")\n shift\n done\n ;;\n --labels)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n LABELS+=(\"--label\" \"$1\")\n shift\n done\n ;;\n --annotations)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ANNOTATIONS+=(\"--annotation\" \"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--pull=never\")\n UNSHARE_ARGS+=(\"--net\")\n buildah_retries=3\n\n set_proxy\n\n for image in $BASE_IMAGES; do\n if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n echo \"Failed to pull base image ${image}\"\n exit 1\n fi\n done\n\n unset_proxy\n\n echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n BUILDAH_ARGS+=(\"--cap-add=all\")\n BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n fi\n if [ -n \"$BUILD_TIMESTAMP\" ]; then\n echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n exit 1\n fi\n # but do set it so that we get all the labels/annotations associated with it\n BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n # Identify the current arch to filter the prefetched content\n PREFETCH_ARCH=\"$(uname -m)\"\n echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n echo \"Prefetched content will be made available\"\n\n cp -r \"/var/workdir/cachi2\" /tmp/\n chmod -R go+rwX /tmp/cachi2\n\n # In case RPMs were prefetched and this is a multi-arch build,\n # clean up the packages that do not match the architecture being built\n RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n echo \"Removing prefetched RPMs from non-matching architectures\"\n PREFETCH_ARCH=\"$(uname -m)\"\n for path in \"$RPM_PREFETCH_DIR\"/*; do\n if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n echo \"Removing: $path\"\n rm -rf \"$path\"\n else\n echo \"Keeping: $path\"\n fi\n done\n fi\n\n VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n sed -E -i \\\n -e 'H;1h;$!d;x' \\\n -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n @igM' \\\n \"$dockerfile_copy\"\n\n prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n mkdir -p \"$YUM_REPOS_D_FETCHED\"\n if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n fi\n fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n \"--label\" \"architecture=$(uname -m)\"\n \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n FINAL_BASE_IMAGE=$(\n # Get the base image of the final stage\n # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n # Run the find_root_stage() function on the final stage\n # If the final stage is scratch or oci-archive, return empty\n jq -r '.Stages as $all_stages |\n def find_root_stage($stage):\n if $stage.From.Stage then\n find_root_stage($all_stages[$stage.From.Stage.Index])\n else\n $stage\n end;\n\n find_root_stage(.Stages[-1]) |\n if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n empty\n else\n .BaseName\n end' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n )\n if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n set_proxy\n buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n unset_proxy\n buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n if [[ \"$label\" != \"--label\" ]]; then\n label_pairs+=(\"$label\")\n fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n echo \"\" \u003e\u003e\"$dockerfile_copy\"\n # Always write labels.json to the new standard location\n echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n # Conditionally write to the old location for backward compatibility\n if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n cp \"$containerignore\" \"$ignorefile_copy\"\n {\n echo \"\"\n echo \"!/labels.json\"\n echo \"!/content-sets.json\"\n } \u003e\u003e\"$ignorefile_copy\"\n BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n mkdir -p /shared/rhsm/etc/pki/entitlement\n mkdir -p /shared/rhsm/etc/pki/consumer\n\n VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n echo \"Adding activation key to the build\"\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n echo \"Pre-registering with subscription manager.\"\n export RETRY_MAX_TRIES=6\n if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n echo \"Subscription-manager register failed\"\n exit 1\n fi\n unset RETRY_MAX_TRIES\n trap 'subscription-manager unregister || true' EXIT\n\n # copy generated certificates to /shared volume\n cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n exit 1\n fi\n # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n # (we set the workdir using 'unshare -w')\n context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n # Instrumented builds (SAST) use this step as their base and add some other tools.\n while read -r volume_mount; do\n VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n while read -r filename; do\n echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n buildah build\n \"${VOLUME_MOUNTS[@]}\"\n \"${BUILDAH_ARGS[@]}\"\n \"${LABELS[@]}\"\n \"${ANNOTATIONS[@]}\"\n --tls-verify=\"$TLSVERIFY\" --no-cache\n --ulimit nofile=4096:4096\n --http-proxy=false\n -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n # Get the image pullspec and filter out a tag if it is not set\n # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n # if buildah did not use that particular image during build because it was skipped\n if [ -n \"$base_image_digest\" ]; then\n echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "gl-multi-component-parent-ozak-on-push-r8tjg-build-container" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"; then\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n echo -n \"${IMAGE}@\"\n cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e/shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "256m", "memory": "512Mi" }, "requests": { "cpu": "256m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n syft_sbom_type=cyclonedx-json@1.5\n ;;\nspdx)\n syft_sbom_type=spdx-json@2.3\n ;;\n*)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ADDITIONAL_BASE_IMAGES+=(\"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/var/workdir/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "emptyDir": {}, "name": "shared" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/commit_sha": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-rbxbrr", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111804", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-push-r8tjg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-ozak' into 'multi-component-parent-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f/records/d0499abd-97a5-4939-8db4-777dfed8e1d4", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"1635086a67b70da955b6ec55379eba702eded716\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-2478d72c89567a3a5a71a1aa38c4ecde-153e1ce0bddd20af-01\"}" }, "creationTimestamp": "2026-05-19T11:43:49Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRunUID": "308865f3-3843-4928-bc02-8eebfe5b4c5f", "tekton.dev/pipelineTask": "build-image-index", "tekton.dev/task": "build-image-index-min" }, "name": "gl-multi-component-parent-ozak-on-push-r8tjg-build-image-index", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-push-r8tjg", "uid": "308865f3-3843-4928-bc02-8eebfe5b4c5f" } ], "resourceVersion": "93256", "uid": "d0499abd-97a5-4939-8db4-777dfed8e1d4" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:43:57Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:43:57Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-parent-o1d912d7d221e1a29904ab19398955129-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, "entryPoint": "build-image-index-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min" } }, "results": [ { "name": "IMAGES", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" } ], "spanContext": { "traceparent": "00-2478d72c89567a3a5a71a1aa38c4ecde-153e1ce0bddd20af-01" }, "startTime": "2026-05-19T11:43:49Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://12ccd7b42ac6521d2d7769bf5c4a8529dfe646f10464e54883b5ee6a38577414", "exitCode": 0, "finishedAt": "2026-05-19T11:43:55Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:53Z" }, "terminationReason": "Completed" }, { "container": "step-create-sbom", "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://9ce06d4361253967ae32e27ba1a40e461b1fc6c36d32f9753efe4baeea6e2d96", "exitCode": 0, "finishedAt": "2026-05-19T11:43:55Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:55Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://4283dad611a02595ff832e31fcaf70a6ee5a4a3abe79965701749d3ebf5f610e", "exitCode": 0, "finishedAt": "2026-05-19T11:43:57Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:43:55Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This takes existing Image Manifests and combines them in an Image Index.", "params": [ { "description": "The target image and tag where the image will be pushed to.", "name": "IMAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "description": "List of Image Manifests to be referenced by the Image Index", "name": "IMAGES", "type": "array" }, { "default": "true", "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.", "name": "ALWAYS_BUILD_INDEX", "type": "string" }, { "default": "vfs", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": "false", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "List of all referenced image manifests", "name": "IMAGES", "type": "string" }, { "description": "Image reference of the built image containing both the repository and the digest", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "vfs" } ], "volumeMounts": [ { "mountPath": "/index-build-data", "name": "shared-dir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716@sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n --image \"$IMAGE\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --buildah-format \"$BUILDAH_FORMAT\" \\\n --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n --additional-tags \"gl-multi-component-parent-ozak-on-push-r8tjg-build-image-index\" \\\n --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n --result-path-images \"/tekton/results/IMAGES\" \\\n --images \"$@\"; then\n echo \"Failed to build image index\"\n exit 1\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-index\n --index-image-pullspec \"$IMAGE_URL\"\n --index-image-digest \"$IMAGE_DIGEST\"\n --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 } } ], "volumes": [ { "emptyDir": {}, "name": "shared-dir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/commit_sha": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-rbxbrr", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111804", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-push-r8tjg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-ozak' into 'multi-component-parent-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f/records/93c8b606-b9ad-4255-a2b6-893fefe53099", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"1635086a67b70da955b6ec55379eba702eded716\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "virus, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-2478d72c89567a3a5a71a1aa38c4ecde-eddd2071ccff3612-01\"}" }, "creationTimestamp": "2026-05-19T11:43:58Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRunUID": "308865f3-3843-4928-bc02-8eebfe5b4c5f", "tekton.dev/pipelineTask": "clamav-scan", "tekton.dev/task": "clamav-scan-min" }, "name": "gl-multi-component-parent-ozak-on-push-r8tjg-clamav-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-push-r8tjg", "uid": "308865f3-3843-4928-bc02-8eebfe5b4c5f" } ], "resourceVersion": "94768", "uid": "93c8b606-b9ad-4255-a2b6-893fefe53099" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:58Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:58Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-parent-ozak-on-push-r8tjg-clamav-scan-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, "entryPoint": "clamav-scan-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\", \"digests\": [\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779191094\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n" } ], "spanContext": { "traceparent": "00-2478d72c89567a3a5a71a1aa38c4ecde-eddd2071ccff3612-01" }, "startTime": "2026-05-19T11:43:58Z", "steps": [ { "container": "step-extract-and-scan-image", "imageID": "quay.io/konflux-ci/clamav-db@sha256:2ee72ac5cda517125824c8139ade1dbf21ee93377e78ece9ef24ec0c55518fe9", "name": "extract-and-scan-image", "provenance": {}, "terminated": { "containerID": "cri-o://17c4a89541192a7f9a1967a513957a47a08b825f4b0e130b65735657620ebd81", "exitCode": 0, "finishedAt": "2026-05-19T11:44:54Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\\\", \\\"digests\\\": [\\\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779191094\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:03Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://22671fa91bacc62227ce1a1983f9a2c253f45a12b515347bec60fadd3d14e802", "exitCode": 0, "finishedAt": "2026-05-19T11:44:57Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\\\", \\\"digests\\\": [\\\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779191094\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:55Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image arch.", "name": "image-arch", "type": "string" }, { "default": "", "description": "unused", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "8", "description": "Maximum number of threads clamd runs.", "name": "clamd-max-threads", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-upload", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "512m", "memory": "3Gi" }, "requests": { "cpu": "512m", "memory": "3Gi" } }, "env": [ { "name": "HOME", "value": "/work" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "IMAGE_DIGEST", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "IMAGE_ARCH" }, { "name": "MAX_THREADS", "value": "8" } ], "image": "quay.io/konflux-ci/clamav-db:latest", "name": "extract-and-scan-image", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n mkdir -p ~/.docker\n echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n# $1: destination - path to the content to scan\n# $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n# $3: digest - digest to add to digests_processed array\n# $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n local destination=\"$1\"\n local suffix=\"$2\"\n local digest=\"$3\"\n local scan_message=\"${4:-Scanning content}\"\n\n db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n echo \"$scan_message. This operation may take a while.\"\n clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n digests_processed+=(\"\\\"$digest\\\"\")\n\n if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n # OPA/EC requires structured data input, add clamAV log into json\n jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o json \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o appstudio \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n\n if [ -n \"$raw_manifest\" ]; then\n media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n # Determine if this is an OCI artifact (not a container image)\n # OCI artifacts typically have:\n # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n # - An explicit artifactType field that is not a container image type\n is_oci_artifact=false\n\n # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n is_oci_artifact=true\n fi\n\n # Check if artifactType is set and is not a container image type\n if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n is_oci_artifact=true\n fi\n\n if [ \"$is_oci_artifact\" = true ]; then\n # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n # This looks like a container image manifest, but get_image_manifests failed\n echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n else\n # Likely an OCI artifact with non-standard media type\n echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n fi\n else\n echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n echo \"Detected container image. Processing image manifests.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n # Proceed only if a specific arch is provided.\n # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n if [ -n \"$IMAGE_ARCH\" ]; then\n arch=\"${IMAGE_ARCH#*/}\"\n if [ \"${arch}\" = \"x86_64\" ]; then\n arch=\"amd64\"\n fi\n\n # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n arch=\"amd64\"\n ;;\n esac\n\n image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n fi\n\n while read -r arch arch_sha; do\n destination=\"content-${arch}\"\n mkdir -p \"$destination\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n exit 0\n fi\n\n # Scan and process container image for this architecture\n scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n {\n \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n \"namespace\" : $item.namespace,\n \"successes\" : (.successes + $item.successes),\n \"failures\" : (.failures + $item.failures),\n \"warnings\" : (.warnings + $item.warnings),\n \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_UPLOAD", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "IMAGE_DIGEST", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n echo \"Upload skipped by parameter.\"\n exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n MEDIA_TYPE=text/vnd.clamav\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n MEDIA_TYPE=application/vnd.konflux.test_output+json\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n echo \"No files found. Skipping upload.\"\n exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n", "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" } ], "volumes": [ { "emptyDir": {}, "name": "dbfolder" }, { "emptyDir": {}, "name": "work" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/commit_sha": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-rbxbrr", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111804", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-push-r8tjg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-ozak' into 'multi-component-parent-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f/records/0dc83878-13ff-48d2-9acf-f0fbc13725ad", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"1635086a67b70da955b6ec55379eba702eded716\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone oci trusted artifacts", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-2478d72c89567a3a5a71a1aa38c4ecde-ff36cdc074579f11-01\"}" }, "creationTimestamp": "2026-05-19T11:41:12Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRunUID": "308865f3-3843-4928-bc02-8eebfe5b4c5f", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone-oci-ta-min" }, "name": "gl-multi-component-parent-ozak-on-push-r8tjg-clone-repository", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-push-r8tjg", "uid": "308865f3-3843-4928-bc02-8eebfe5b4c5f" } ], "resourceVersion": "89363", "uid": "0dc83878-13ff-48d2-9acf-f0fbc13725ad" }, "spec": { "params": [ { "name": "url", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "revision", "value": "1635086a67b70da955b6ec55379eba702eded716" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716.git" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "basic-auth", "secret": { "secretName": "pac-gitauth-rbxbrr" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:41:21Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:41:21Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-parent-ob2de3357f93a2d74e9d2f475c9abbd0b-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, "entryPoint": "git-clone-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "1635086a67b70da955b6ec55379eba702eded716" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "commit", "type": "string", "value": "1635086a67b70da955b6ec55379eba702eded716" }, { "name": "commit-timestamp", "type": "string", "value": "1779190859" }, { "name": "short-commit", "type": "string", "value": "1635086" }, { "name": "url", "type": "string", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74" } ], "spanContext": { "traceparent": "00-2478d72c89567a3a5a71a1aa38c4ecde-ff36cdc074579f11-01" }, "startTime": "2026-05-19T11:41:12Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "provenance": {}, "terminated": { "containerID": "cri-o://9c96e2e169cade9632fb56416afa40a79a48f9ee9e7b87e319169cb7ee32ebad", "exitCode": 0, "finishedAt": "2026-05-19T11:41:19Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"1635086a67b70da955b6ec55379eba702eded716\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"1635086a67b70da955b6ec55379eba702eded716\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190859\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"1635086\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:18Z" }, "terminationReason": "Completed" }, { "container": "step-symlink-check", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "provenance": {}, "terminated": { "containerID": "cri-o://968b1b1ed595298e5607614bff90fa0fa252528cd5209af47a7d94c9d2f82880", "exitCode": 0, "finishedAt": "2026-05-19T11:41:19Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"1635086a67b70da955b6ec55379eba702eded716\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1},{\"key\":\"commit\",\"value\":\"1635086a67b70da955b6ec55379eba702eded716\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190859\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"1635086\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:19Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://fb508b3823594690cb7c6f58a9778b42ffd615924195e9f24556261aa909b8d4", "exitCode": 0, "finishedAt": "2026-05-19T11:41:21Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"1635086a67b70da955b6ec55379eba702eded716\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74\",\"type\":1},{\"key\":\"commit\",\"value\":\"1635086a67b70da955b6ec55379eba702eded716\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190859\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"1635086\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:19Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.", "params": [ { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "7", "description": "Length of short commit SHA", "name": "shortCommitLength", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n", "name": "submodulePaths", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "/tekton/home", "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n", "name": "userHome", "type": "string" }, { "default": "false", "description": "Log the commands that are executed during `git-clone`'s operation.", "name": "verbose", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" }, { "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" } ], "steps": [ { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "PARAM_URL", "value": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn" }, { "name": "PARAM_REVISION", "value": "1635086a67b70da955b6ec55379eba702eded716" }, { "name": "PARAM_REFSPEC" }, { "name": "PARAM_SUBMODULES", "value": "true" }, { "name": "PARAM_SUBMODULE_PATHS" }, { "name": "PARAM_DEPTH", "value": "1" }, { "name": "PARAM_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "PARAM_SSL_VERIFY", "value": "true" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "PARAM_VERBOSE", "value": "false" }, { "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "PARAM_USER_HOME", "value": "/tekton/home" }, { "name": "PARAM_FETCH_TAGS", "value": "false" }, { "name": "PARAM_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "PARAM_TARGET_BRANCH", "value": "main" }, { "name": "PARAM_MERGE_SOURCE_REPO_URL" }, { "name": "PARAM_MERGE_SOURCE_DEPTH" }, { "name": "WORKSPACE_SSH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_SSH_DIRECTORY_PATH" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND", "value": "true" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH", "value": "/workspace/basic-auth" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n # Compatibility with kubernetes.io/basic-auth secrets\n elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n else\n echo \"Unknown basic-auth workspace format\"\n exit 1\n fi\n chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n -url=\"${PARAM_URL}\" \\\n -revision=\"${PARAM_REVISION}\" \\\n -refspec=\"${PARAM_REFSPEC}\" \\\n -path=\"${CHECKOUT_DIR}\" \\\n -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n -submodules=\"${PARAM_SUBMODULES}\" \\\n -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n -depth=\"${PARAM_DEPTH}\" \\\n -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n # Determine if merging from a different repository or the same one\n if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n normalize_url() {\n echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n }\n\n NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n MERGE_REMOTE=\"origin\"\n else\n echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n echo \"Adding remote 'merge-source'...\"\n git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n MERGE_REMOTE=\"merge-source\"\n fi\n else\n echo \"Merging from the same repository (origin)\"\n MERGE_REMOTE=\"origin\"\n fi\n\n echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n else\n retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n fi\n\n echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n git config --global user.email \"tekton-git-clone@tekton.dev\"\n git config --global user.name \"Tekton Git Clone Task\"\n\n if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n echo \"--- Git Status ---\"\n git status\n echo \"------------------\"\n exit 1\n fi\n\n # Check if there are changes staged for commit\n if git diff --staged --quiet; then\n echo \"No diff was found, skipping merge...\" \u003e\u00262\n else\n echo \"Merge successful (no conflicts found), committing...\"\n if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n exit 1\n fi\n MERGED_SHA=$(git rev-parse HEAD)\n echo \"New HEAD after merge: ${MERGED_SHA}\"\n echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n fi\n\nelse\n echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n echo \"Fetching tags\"\n retry git fetch --tags\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "computeResources": {}, "env": [ { "name": "PARAM_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n while read -r symlink; do\n target=$(readlink -m \"$symlink\")\n if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n fi\n done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n return 1\n fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n echo \"Running symlink check\"\n check_symlinks\nfi\n", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716.git", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/commit_sha": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-rbxbrr", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111804", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-push-r8tjg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-ozak' into 'multi-component-parent-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f/records/bdbf5536-f2c8-40b2-9c71-2d9eae7d51ab", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"1635086a67b70da955b6ec55379eba702eded716\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-2478d72c89567a3a5a71a1aa38c4ecde-4372c6f736856398-01\"}" }, "creationTimestamp": "2026-05-19T11:41:06Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRunUID": "308865f3-3843-4928-bc02-8eebfe5b4c5f", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init" }, "name": "gl-multi-component-parent-ozak-on-push-r8tjg-init", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-push-r8tjg", "uid": "308865f3-3843-4928-bc02-8eebfe5b4c5f" } ], "resourceVersion": "89091", "uid": "bdbf5536-f2c8-40b2-9c71-2d9eae7d51ab" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:41:12Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:41:12Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-parent-ozak-on-push-r8tjg-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "spanContext": { "traceparent": "00-2478d72c89567a3a5a71a1aa38c4ecde-4372c6f736856398-01" }, "startTime": "2026-05-19T11:41:06Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "init", "provenance": {}, "terminated": { "containerID": "cri-o://46416822f1c48aa32507f7489835eebf94eb1d9c5fa4025915d1f283ac29bb09", "exitCode": 0, "finishedAt": "2026-05-19T11:41:11Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:41:11Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/commit_sha": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-rbxbrr", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111804", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-push-r8tjg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-ozak' into 'multi-component-parent-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f/records/e1a817e5-cbbe-40ba-96f4-00c125012aca", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"1635086a67b70da955b6ec55379eba702eded716\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-2478d72c89567a3a5a71a1aa38c4ecde-177aff4dce4b9512-01\"}" }, "creationTimestamp": "2026-05-19T11:43:58Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRunUID": "308865f3-3843-4928-bc02-8eebfe5b4c5f", "tekton.dev/pipelineTask": "sast-shell-check", "tekton.dev/task": "sast-shell-check-oci-ta-min" }, "name": "gl-multi-component-parent-ozak-on-push-r8tjg-sast-shell-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-push-r8tjg", "uid": "308865f3-3843-4928-bc02-8eebfe5b4c5f" } ], "resourceVersion": "93975", "uid": "e1a817e5-cbbe-40ba-96f4-00c125012aca" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-shell-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:16Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:16Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-parent-o600e085c7fa74170ad2df53ee553079d-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0" }, "entryPoint": "sast-shell-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:44:14+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-2478d72c89567a3a5a71a1aa38c4ecde-177aff4dce4b9512-01" }, "startTime": "2026-05-19T11:43:58Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://6810175b1db1f6c9debaf9ca59ca436072fb2e5ce1baad9ca9923e0b258920e2", "exitCode": 0, "finishedAt": "2026-05-19T11:44:03Z", "reason": "Completed", "startedAt": "2026-05-19T11:44:02Z" }, "terminationReason": "Completed" }, { "container": "step-sast-shell-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-shell-check", "provenance": {}, "terminated": { "containerID": "cri-o://6dbbd87f26c76c5e3a51b6febe05e2b7c92c6d068440f8ec3838c181a4882a07", "exitCode": 0, "finishedAt": "2026-05-19T11:44:14Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:14+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:04Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://dc738a8cf2e52373b853e687377cf2dab694d273ef20d7e1cb17b25c64b0ee6a", "exitCode": 0, "finishedAt": "2026-05-19T11:44:15Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:14+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:14Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "true", "description": "Whether to include important findings only", "name": "IMP_FINDINGS_ONLY", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Image digest to report findings for.", "name": "image-digest", "type": "string" }, { "default": "", "description": "Image URL.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "128m", "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "IMP_FINDINGS_ONLY", "value": "true" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-shell-check", "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n resolved_path=$(realpath -m \"$potential_path\")\n\n # ensure resolved path is still within SOURCE_CODE_DIR\n if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n ALL_TARGETS+=(\"$resolved_path\")\n else\n echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n exit 1\n fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n read -r quota period \u003c/sys/fs/cgroup/cpu.max\n if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n export SC_JOBS=$(((quota + period - 1) / period))\n echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n --mode=json\n --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n # predefined list of shellcheck important findings\n CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n CSGREP_OPTS+=(\n --event=\"$CSGREP_EVENT_FILTER\"\n )\nelse\n CSGREP_OPTS+=(\n --event=\"error|warning\"\n )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n echo \"Error occurred while running 'run-shellcheck.sh'\"\n note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n else\n mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "IMAGE_DIGEST", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n echo 'No image-url or image-digest param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n # Determine the media type based on the file extension\n if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n MEDIA_TYPE=\"application/json\"\n else\n MEDIA_TYPE=\"application/sarif+json\"\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n exit 1\n fi\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/commit_sha": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-rbxbrr", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111804", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-push-r8tjg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-ozak' into 'multi-component-parent-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f/records/f145453f-fb97-43c2-909b-62d493461b3c", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"1635086a67b70da955b6ec55379eba702eded716\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-2478d72c89567a3a5a71a1aa38c4ecde-b2b8263dfa225158-01\"}" }, "creationTimestamp": "2026-05-19T11:43:58Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRunUID": "308865f3-3843-4928-bc02-8eebfe5b4c5f", "tekton.dev/pipelineTask": "sast-unicode-check", "tekton.dev/task": "sast-unicode-check-oci-ta-min" }, "name": "gl-multi-component-parent-ozak-on-push-r8tjg-sast-unicode-check", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-push-r8tjg", "uid": "308865f3-3843-4928-bc02-8eebfe5b4c5f" } ], "resourceVersion": "93688", "uid": "f145453f-fb97-43c2-909b-62d493461b3c" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:06Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:06Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-parent-ob86f217e1abdf2f6d5a1d203e2c1f489-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, "entryPoint": "sast-unicode-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:44:05+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-2478d72c89567a3a5a71a1aa38c4ecde-b2b8263dfa225158-01" }, "startTime": "2026-05-19T11:43:58Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://079067b119b527fa21336764bd55691bf8ff58531a49d5c338a8e16141d570da", "exitCode": 0, "finishedAt": "2026-05-19T11:44:03Z", "reason": "Completed", "startedAt": "2026-05-19T11:44:02Z" }, "terminationReason": "Completed" }, { "container": "step-sast-unicode-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-unicode-check", "provenance": {}, "terminated": { "containerID": "cri-o://ab7e35f5d69a05ece9df109bf644b47915d4c387244b0a6414cb0754916771ed", "exitCode": 0, "finishedAt": "2026-05-19T11:44:05Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:05+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:04Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://c6276bdb94ec172288e0ecdca4e328901571f54b6658a06ef2b1552f202a4022", "exitCode": 0, "finishedAt": "2026-05-19T11:44:06Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:05+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:05Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans source code for non-printable unicode characters in all text files.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "-p bidi -v -d -t", "description": "arguments for find-unicode-control command.", "name": "FIND_UNICODE_CONTROL_ARGS", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "description": "Image digest used for ORAS upload.", "name": "image-digest", "type": "string" }, { "description": "Image URL used for ORAS upload.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak@sha256:64d1c4de34322957636a5f68b6c6f544916dda70fd333e761f1dbbb762b7fc74=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "FIND_UNICODE_CONTROL_ARGS", "value": "-p bidi -v -d -t" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_CODE_DIR", "value": "/var/workdir" }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-unicode-check", "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n \u003eraw_sast_unicode_check_out.txt \\\n 2\u003eraw_sast_unicode_check_out.log ||\n FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n echo \"Failed to run find-unicode-control command\" \u003e\u00262\n cat raw_sast_unicode_check_out.log\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n --mode=json\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"${SCAN_PROP}\"\n --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n cat processed_sast_unicode_check_out.err\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # Build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n # Append --record-excluded option if RECORD_EXCLUDED is true\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n else\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n echo \"sast-unicode-check test failed because of the following issues:\"\n cat sast_unicode_check_out.json\n TEST_OUTPUT=\n parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "IMAGE_DIGEST", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n echo 'No image-url param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n MEDIA_TYPE=application/json\n else\n MEDIA_TYPE=application/sarif+json\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/tree/1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/commit_sha": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-rbxbrr", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537111804", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-parent-ozak-on-push-r8tjg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-ozak' into 'multi-component-parent-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn/-/commit/1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337794", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337794", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f/records/46559b17-5535-47db-9eae-71a1ccbd74b5", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-pqmvxn\",\"commit\":\"1635086a67b70da955b6ec55379eba702eded716\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/308865f3-3843-4928-bc02-8eebfe5b4c5f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-2478d72c89567a3a5a71a1aa38c4ecde-f1932583dddd4182-01\"}" }, "creationTimestamp": "2026-05-19T11:43:58Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-parent-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-parent-pqmvxn", "pipelinesascode.tekton.dev/sha": "1635086a67b70da955b6ec55379eba702eded716", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRun": "gl-multi-component-parent-ozak-on-push-r8tjg", "tekton.dev/pipelineRunUID": "308865f3-3843-4928-bc02-8eebfe5b4c5f", "tekton.dev/pipelineTask": "tpa-scan", "tekton.dev/task": "tpa-scan" }, "name": "gl-multi-component-parent-ozak-on-push-r8tjg-tpa-scan", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-parent-ozak-on-push-r8tjg", "uid": "308865f3-3843-4928-bc02-8eebfe5b4c5f" } ], "resourceVersion": "93826", "uid": "46559b17-5535-47db-9eae-71a1ccbd74b5" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskRef": { "params": [ { "name": "name", "value": "tpa-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:44:11Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:44:11Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-component-parent-ozak-on-push-r8tjg-tpa-scan-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, "entryPoint": "tpa-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\", \"digests\": [\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\"]}}\n" }, { "name": "REPORTS", "type": "string", "value": "{\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\":\"sha256:572db23414e1560d9c4875a81410cf6482bb6f368545868f930acdc1729e642e\"}\n" }, { "name": "SCAN_OUTPUT", "type": "string", "value": "{\"vulnerabilities\":{\"critical\":4,\"high\":30,\"medium\":53,\"low\":9,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:44:10+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-2478d72c89567a3a5a71a1aa38c4ecde-f1932583dddd4182-01" }, "startTime": "2026-05-19T11:43:58Z", "steps": [ { "container": "step-get-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "get-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://510440584fabc648565b514762543bde4d2de234d1d710fcaacd27b9e662be22", "exitCode": 0, "finishedAt": "2026-05-19T11:44:06Z", "reason": "Completed", "startedAt": "2026-05-19T11:44:04Z" }, "terminationReason": "Completed" }, { "container": "step-oci-attach-report", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "provenance": {}, "terminated": { "containerID": "cri-o://0fa2e02dced6b647b9311690d439ca3c6e8c09eccc8143a9a7c8efa4ec06fe89", "exitCode": 0, "finishedAt": "2026-05-19T11:44:08Z", "reason": "Completed", "startedAt": "2026-05-19T11:44:06Z" }, "terminationReason": "Completed" }, { "container": "step-conftest-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "conftest-vulnerabilities", "provenance": {}, "terminated": { "containerID": "cri-o://f169c59171fa1ca0289a057612bd9e704624814c5f3c789b80c9b126e0066a53", "exitCode": 0, "finishedAt": "2026-05-19T11:44:10Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716\\\", \\\"digests\\\": [\\\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e\\\":\\\"sha256:572db23414e1560d9c4875a81410cf6482bb6f368545868f930acdc1729e642e\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":4,\\\"high\\\":30,\\\"medium\\\":53,\\\"low\\\":9,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:44:10+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:44:09Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "The platform which will be scanned by this task.", "name": "image-platform", "type": "string" }, { "default": "https://exhort.stage.devshift.net/api/v5/analysis", "description": "The url of the TPA instance which will be used for scanning.", "name": "tpa-url", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-oci-attach-report", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "TPA scan result.", "name": "SCAN_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" }, { "description": "Mapping of image digests to report digests", "name": "REPORTS", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "800m", "memory": "2Gi" }, "requests": { "cpu": "800m", "memory": "2Gi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" }, { "name": "IMAGE_DIGEST", "value": "sha256:3f5801867e73a6ab6a1cb90385a2295f5dca688075139e04a45f99c06f4a932e" }, { "name": "IMAGE_PLATFORM" }, { "name": "TPA_URL", "value": "https://exhort.stage.devshift.net/api/v5/analysis" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "imagePullPolicy": "Always", "name": "get-vulnerabilities", "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n done\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n\ntpa_scan() {\n local sbom_file=${1}\n local arch=${2}\n local sbom_format\n\n sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n local arch=\"$1\"\n local sha_file=\"image-manifest-${arch}.sha\"\n local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n local arch_sha=\"\"\n\n if [ -e \"${sha_file}\" ]; then\n arch_sha=$(\u003c\"${sha_file}\")\n arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n else\n echo \"Couldn't find the SHA file for the requested architecture.\"\n exit 1\n fi\n\n echo \"Selecting auth\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Attempt to download the SBOM file via cosign\n\n if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n echo \"Unable to download SBOM for the architecture ${arch}.\"\n exit 1\n fi\n\n if [ -e \"${sbom_file_path}\" ]; then\n local arch_sha\n arch_sha=$(\u003c\"$sha_file\")\n\n echo \"Running TPA scan on $arch image manifest...\"\n tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n else\n echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n exit 1\n fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n # Validate against supported arch list. If it's not a known arch, fallback to amd64\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 1\n ;;\n esac\n\n run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n for sha_file in image-manifest-*.sha; do\n if [ -e \"$sha_file\" ]; then\n arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n run_tpa_on_arch \"$arch\"\n fi\n done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_OCI_ATTACH_REPORT", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n echo 'OCI attach report skipped by parameter.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n echo 'No TPA reports generated. Skipping upload.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n report_file=\"$1\"\n arch=\"${report_file/*-}\"\n echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n image_ref=\"${repository}@${digest}\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n echo \"Attaching $f to ${image_ref}\"\n if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n then\n echo \"Failed to attach ${f} to ${image_ref}\"\n exit 1\n fi\n # shellcheck disable=SC2016\n reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "conftest-vulnerabilities", "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n if [ ! -s \"$file\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n else\n /usr/bin/conftest test --no-fail $file \\\n --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n fi\n\n #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n result=$(jq -rce \\\n '{\n vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n },\n unpatched_vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n }\n }' \"$file\")\n\n scan_result=$(jq -s -rce \\\n '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/tree/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/commit_sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "build.appstudio.redhat.com/target_branch": "multi-component-child-base-ozak", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "multi-component-child-base-ozak", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jtxnsl", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537108878", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/build-e2e-xudt/tekton.dev~v1~PipelineRun/gl-multi-component-child-ozak-on-push-74rs9", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-ozak\"", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-ozak' into 'multi-component-child-base-ozak'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn/-/commit/a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-ozak", "pipelinesascode.tekton.dev/source-project-id": "82337801", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "82337801", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492/records/63df9b4b-858b-4f4c-a598-463f44db43fe", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-pqmvxn\",\"commit\":\"a6b4ba1a6953f92be05a2086bf58de73aadc9cc1\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-xudt/results/27a968ed-f718-49fc-ab32-71b6240d3492", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bd24a6e803660a298babd09432c7cb55-ac9bc11541188321-01\"}" }, "creationTimestamp": "2026-05-19T11:40:12Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "build-suite-component-update-whwy", "appstudio.openshift.io/component": "gl-multi-component-child-ozak", "kueue.x-k8s.io/priority-class": "konflux-post-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-ozak-on-push", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-build-nudge-child-pqmvxn", "pipelinesascode.tekton.dev/sha": "a6b4ba1a6953f92be05a2086bf58de73aadc9cc1", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRun": "gl-multi-component-child-ozak-on-push-74rs9", "tekton.dev/pipelineRunUID": "27a968ed-f718-49fc-ab32-71b6240d3492", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies-oci-ta-min" }, "name": "gl-multi-d9eaaa4995aa12b0512a4b569ed94a3b-prefetch-dependencies", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-multi-component-child-ozak-on-push-74rs9", "uid": "27a968ed-f718-49fc-ab32-71b6240d3492" } ], "resourceVersion": "88369", "uid": "63df9b4b-858b-4f4c-a598-463f44db43fe" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1.prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-child-ozak", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "git-basic-auth", "secret": { "secretName": "pac-gitauth-jtxnsl" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:40:54Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:40:54Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-multi-d9eaaa4995aa12b05110357bb1df4f62ec88a30b4a634fab04-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, "entryPoint": "prefetch-dependencies-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min" } }, "results": [ { "name": "CACHI2_ARTIFACT", "type": "string", "value": "" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252" } ], "spanContext": { "traceparent": "00-bd24a6e803660a298babd09432c7cb55-ac9bc11541188321-01" }, "startTime": "2026-05-19T11:40:12Z", "steps": [ { "container": "step-skip-ta", "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "provenance": {}, "terminated": { "containerID": "cri-o://8086f868886762e8da0a6656759f9206057a5f75acc6bcbd6b0195f76ac5e58f", "exitCode": 0, "finishedAt": "2026-05-19T11:40:19Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:19Z" }, "terminationReason": "Completed" }, { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://2d2c335f3fbfd6801304dc7a716893254d23327db19a816ad79f3ff48f8bde25", "exitCode": 0, "finishedAt": "2026-05-19T11:40:19Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:19Z" }, "terminationReason": "Completed" }, { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "provenance": {}, "terminated": { "containerID": "cri-o://b0d1acfe796a273cc64b9268f5839b482c2bb4a281f5ab02653d5e662d6f3a49", "exitCode": 0, "finishedAt": "2026-05-19T11:40:53Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:19Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "cri-o://2d5f516d9fc71ca6745bd9267c7516926126637f2be482787f62247a39f62fb0", "exitCode": 0, "finishedAt": "2026-05-19T11:40:53Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:40:53Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" } ], "results": [ { "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "computeResources": {}, "env": [ { "name": "INPUT" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252" } ], "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n mkdir -p /var/workdir/source\n mkdir -p /var/workdir/cachi2\n echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n" }, { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak@sha256:40960e010180ab93cf51ffe4c84b4610881f59393d5a35a592c4f5cf13583252=/var/workdir/source" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/var/workdir/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/var/workdir/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY", "value": "/workspace/git-basic-auth" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" } ], "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-child-ozak:a6b4ba1a6953f92be05a2086bf58de73aadc9cc1.prefetch", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source", "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "emptyDir": {}, "name": "config" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.redhat.com/nudged-components": "gl-multi-component-child-ozak", "build.appstudio.redhat.com/nudging-commit": "1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/nudging-component": "gl-multi-component-parent-ozak", "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-xudt/gl-multi-component-parent-ozak:1635086a67b70da955b6ec55379eba702eded716", "build.appstudio.redhat.com/nudging-pipeline": "gl-multi-component-parent-ozak-on-push-r8tjg", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-xudt/results/9307bae6-06bc-4226-a5df-80e9f2987bcc/records/4800a113-a4fb-40ed-bc1e-96268ba16723", "results.tekton.dev/result": "build-e2e-xudt/results/9307bae6-06bc-4226-a5df-80e9f2987bcc", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-e24ecaca1a018bcb33a0d310acb6ce91-8e665063b64700e3-01\"}" }, "creationTimestamp": "2026-05-19T11:44:59Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "build.appstudio.redhat.com/type": "nudge", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-pipeline-1779191098-129d5", "tekton.dev/pipelineRun": "renovate-pipeline-1779191098-129d5", "tekton.dev/pipelineRunUID": "9307bae6-06bc-4226-a5df-80e9f2987bcc", "tekton.dev/pipelineTask": "renovate" }, "name": "renovate-pipeline-1779191098-129d5-renovate", "namespace": "build-e2e-xudt", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-pipeline-1779191098-129d5", "uid": "9307bae6-06bc-4226-a5df-80e9f2987bcc" } ], "resourceVersion": "97261", "uid": "4800a113-a4fb-40ed-bc1e-96268ba16723" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-gl-multi-component-parent-ozak", "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_2002d2b774 RENOVATE_CONFIG_FILE=/configs/gl-multi-component-child-ozak-7a0ed.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_xudt_gl_multi_component_parent_ozak_db7fd596a4','password':'${TOKEN_cbd2434429}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1779191098-129d5" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1779191098-129d5" }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "trusted-ca", "readOnly": true } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1779191098-129d5" }, "name": "renovate-pipeline-1779191098-129d5" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "renovate-ca-1779191098-129d5" }, "name": "trusted-ca" } ] }, "timeout": "2h0m0s" }, "status": { "completionTime": "2026-05-19T11:47:11Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:47:11Z", "message": "the step \"renovate\" in TaskRun \"renovate-pipeline-1779191098-129d5-renovate\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:29a2f31\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-pipeline-1779191098-129d5-renovate-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-e24ecaca1a018bcb33a0d310acb6ce91-8e665063b64700e3-01" }, "startTime": "2026-05-19T11:44:59Z", "steps": [ { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T11:47:11Z", "message": "Step renovate terminated as pod renovate-pipeline-1779191098-129d5-renovate-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T11:44:59Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_2002d2b774 RENOVATE_CONFIG_FILE=/configs/gl-multi-component-child-ozak-7a0ed.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_xudt_gl_multi_component_parent_ozak_db7fd596a4','password':'${TOKEN_cbd2434429}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1779191098-129d5" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1779191098-129d5" }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "trusted-ca", "readOnly": true } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1779191098-129d5" }, "name": "renovate-pipeline-1779191098-129d5" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "renovate-ca-1779191098-129d5" }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb/records/a8738de6-bd3a-4446-aa8a-89b51b12db17", "results.tekton.dev/result": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f7c922a491d27ba52d263f5a6f965e7a-57b97de89619adcf-01\"}" }, "creationTimestamp": "2026-05-19T11:26:33Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.3", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-cddphguiiu", "tekton.dev/pipelineRunUID": "959fec55-5f01-42c4-afcd-2665ae90ffbb", "tekton.dev/pipelineTask": "apply-tags", "tekton.dev/task": "apply-tags" }, "name": "buildah-demo-cddphguiiu-apply-tags", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-cddphguiiu", "uid": "959fec55-5f01-42c4-afcd-2665ae90ffbb" } ], "resourceVersion": "64060", "uid": "a8738de6-bd3a-4446-aa8a-89b51b12db17" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu" }, { "name": "IMAGE_DIGEST", "value": "sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "apply-tags" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:26:38Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:26:38Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-cddphguiiu-apply-tags-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66" }, "entryPoint": "apply-tags", "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags" } }, "spanContext": { "traceparent": "00-f7c922a491d27ba52d263f5a6f965e7a-57b97de89619adcf-01" }, "startTime": "2026-05-19T11:26:33Z", "steps": [ { "container": "step-apply-additional-tags", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "apply-additional-tags", "provenance": {}, "terminated": { "containerID": "cri-o://e0e3776a0b094b715f8f6c999c75e79cf611d3c52df675bc914984609978c888", "exitCode": 0, "finishedAt": "2026-05-19T11:26:37Z", "reason": "Completed", "startedAt": "2026-05-19T11:26:37Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Applies additional tags to the built image.", "params": [ { "description": "Image repository and tag reference of the the built image.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest of the built image.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": [], "description": "Additional tags that will be applied to the image in the registry.", "name": "ADDITIONAL_TAGS", "type": "array" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "info", "description": "Log level to use in the task. See golang logrus docs for available levels.", "name": "LOG_LEVEL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "args": [ "--image-url", "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu", "--digest", "sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235", "--tags", "--tags-from-image-label", "konflux.additional-tags" ], "command": [ "konflux-build-cli", "image", "apply-tags" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "apply-additional-tags" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-e6844c1a76", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb/records/a08319a0-ada3-4345-955c-1d102ba1faf1", "results.tekton.dev/result": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f7c922a491d27ba52d263f5a6f965e7a-7f2ff0633d2a8502-01\"}" }, "creationTimestamp": "2026-05-19T11:23:46Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.9.3", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-cddphguiiu", "tekton.dev/pipelineRunUID": "959fec55-5f01-42c4-afcd-2665ae90ffbb", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah" }, "name": "buildah-demo-cddphguiiu-build-container", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-cddphguiiu", "uid": "959fec55-5f01-42c4-afcd-2665ae90ffbb" } ], "resourceVersion": "62681", "uid": "a08319a0-ada3-4345-955c-1d102ba1faf1" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu" }, { "name": "DOCKERFILE", "value": "Containerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "" }, { "name": "COMMIT_SHA", "value": "be3214825d8af1a44d1406df6233660e8372d26f" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://github.com/conforma/golden-container.git" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "buildah" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah:0.9@sha256:62f09c50d552eac57e17638c67e88b0982352a71975858c8ba262bcff293de06" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "source", "persistentVolumeClaim": { "claimName": "app-studio-default-workspace" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:25:50Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:25:50Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-cddphguiiu-build-container-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "62f09c50d552eac57e17638c67e88b0982352a71975858c8ba262bcff293de06" }, "entryPoint": "buildah", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah" } }, "results": [ { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu" }, { "name": "SBOM_BLOB_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images@sha256:fc2138f2ea87ebd95d69433eb5d081bb9841b0e1d2fd9b418cbef8856373f1e7" } ], "spanContext": { "traceparent": "00-f7c922a491d27ba52d263f5a6f965e7a-7f2ff0633d2a8502-01" }, "startTime": "2026-05-19T11:23:46Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://cde01bb81d4681a3932e45daf71347b41754a5ecd4f38b49126346503fd2160c", "exitCode": 0, "finishedAt": "2026-05-19T11:24:59Z", "reason": "Completed", "startedAt": "2026-05-19T11:24:30Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://58bb9988e2b91090f3dbaa0f80e8938b6bd6d550a08b87a8eae22c66b742ae7e", "exitCode": 0, "finishedAt": "2026-05-19T11:25:07Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:24:59Z" }, "terminationReason": "Completed" }, { "container": "step-sbom-syft-generate", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "provenance": {}, "terminated": { "containerID": "cri-o://fa754e7c9a807fd995db0634ef180185b00da44694416e7bde7d95bfa2efda1f", "exitCode": 0, "finishedAt": "2026-05-19T11:25:10Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:25:07Z" }, "terminationReason": "Completed" }, { "container": "step-prepare-sboms", "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "provenance": {}, "terminated": { "containerID": "cri-o://a33f54be3cc3a7eaf85e5b5aaf082c5f62507c6c2fa7301e9a6722f95f02ca3e", "exitCode": 0, "finishedAt": "2026-05-19T11:25:24Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:25:10Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://0c43fced2ec24a883f746b64289da3d0f6e2a750e9cddaa1ed61771c768493aa", "exitCode": 0, "finishedAt": "2026-05-19T11:25:49Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:fc2138f2ea87ebd95d69433eb5d081bb9841b0e1d2fd9b418cbef8856373f1e7\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:25:25Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "cpu": "1", "memory": "4Gi" } }, "env": [ { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "HERMETIC", "value": "false" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "CONTEXT", "value": "." }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "IMAGE_EXPIRES_AFTER" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" }, { "name": "TARGET_STAGE" }, { "name": "ENTITLEMENT_SECRET", "value": "etc-pki-entitlement" }, { "name": "ACTIVATION_KEY", "value": "activation-key" }, { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "BUILD_ARGS_FILE" }, { "name": "ADD_CAPABILITIES" }, { "name": "SQUASH", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "ANNOTATIONS_FILE" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SKIP_INJECTIONS", "value": "false" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" } ] }, "steps": [ { "args": [ "--build-args", "--env", "--labels", "--annotations" ], "computeResources": { "limits": { "cpu": "4600m", "memory": "8Gi" }, "requests": { "cpu": "4600m", "memory": "8Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "be3214825d8af1a44d1406df6233660e8372d26f" }, { "name": "SOURCE_URL", "value": "https://github.com/conforma/golden-container.git" }, { "name": "DOCKERFILE", "value": "Containerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n fi\n fi\n}\n\nfunction unset_proxy {\n echo \"[$(date --utc -Ins)] Unsetting proxy\"\n unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n \"$source_dir_path\" | \"$source_dir_path/\"*)\n # path is valid, do nothing\n ;;\n *)\n echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n echo \"Source path: $source_dir_path\" \u003e\u00262\n echo \"Resolved path: $context_dir_path\" \u003e\u00262\n exit 1\n ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n # Instrumented builds (SAST) use this custom dockerfile step as their base\n dockerfile_path=\"$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e /etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n while IFS= read -r line || [[ -n \"$line\" ]]; do\n # Skip empty lines and comments\n if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n ANNOTATIONS+=(\"--annotation\" \"$line\")\n fi\n done \u003c \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --build-args)\n shift\n # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do build_args+=(\"$1\"); shift; done\n ;;\n --env)\n shift\n # Collect env entries of the form KEY=value\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do env_vars+=(\"$1\"); shift; done\n ;;\n --labels)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do LABELS+=(\"--label\" \"$1\"); shift; done\n ;;\n --annotations)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ANNOTATIONS+=(\"--annotation\" \"$1\"); shift; done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e /shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--pull=never\")\n UNSHARE_ARGS+=(\"--net\")\n buildah_retries=3\n\n set_proxy\n\n for image in $BASE_IMAGES; do\n if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"\n then\n echo \"Failed to pull base image ${image}\"\n exit 1\n fi\n done\n\n unset_proxy\n\n echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n BUILDAH_ARGS+=(\"--cap-add=all\")\n BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ] ; then\n BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ] ; then\n BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n fi\n if [ -n \"$BUILD_TIMESTAMP\" ]; then\n echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n exit 1\n fi\n # but do set it so that we get all the labels/annotations associated with it\n BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/workspace/source/cachi2/cachi2.env\" ]; then\n # Identify the current arch to filter the prefetched content\n PREFETCH_ARCH=\"$(uname -m)\"\n echo \"$PREFETCH_ARCH\" \u003e /shared/prefetch-arch\n\n echo \"Prefetched content will be made available\"\n\n cp -r \"/workspace/source/cachi2\" /tmp/\n chmod -R go+rwX /tmp/cachi2\n\n # In case RPMs were prefetched and this is a multi-arch build,\n # clean up the packages that do not match the architecture being built\n RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n echo \"Removing prefetched RPMs from non-matching architectures\"\n PREFETCH_ARCH=\"$(uname -m)\"\n for path in \"$RPM_PREFETCH_DIR\"/*; do\n if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n echo \"Removing: $path\"\n rm -rf \"$path\"\n else\n echo \"Keeping: $path\"\n fi\n done\n fi\n\n VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n sed -E -i \\\n -e 'H;1h;$!d;x' \\\n -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n @igM' \\\n \"$dockerfile_copy\"\n\n prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n mkdir -p \"$YUM_REPOS_D_FETCHED\"\n if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n fi\n fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n \"--label\" \"architecture=$(uname -m)\"\n \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n FINAL_BASE_IMAGE=$(\n # Get the base image of the final stage\n # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n # Run the find_root_stage() function on the final stage\n # If the final stage is scratch or oci-archive, return empty\n jq -r '.Stages as $all_stages |\n def find_root_stage($stage):\n if $stage.From.Stage then\n find_root_stage($all_stages[$stage.From.Stage.Index])\n else\n $stage\n end;\n\n find_root_stage(.Stages[-1]) |\n if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n empty\n else\n .BaseName\n end' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n )\n if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n set_proxy\n buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null` `\n unset_proxy\n buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n if [[ \"$label\" != \"--label\" ]]; then\n label_pairs+=(\"$label\")\n fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n echo \"\" \u003e\u003e\"$dockerfile_copy\"\n # Always write labels.json to the new standard location\n echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n # Conditionally write to the old location for backward compatibility\n if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n cp \"$containerignore\" \"$ignorefile_copy\"\n {\n echo \"\"\n echo \"!/labels.json\"\n echo \"!/content-sets.json\"\n } \u003e\u003e \"$ignorefile_copy\"\n BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n mkdir -p /shared/rhsm/etc/pki/entitlement\n mkdir -p /shared/rhsm/etc/pki/consumer\n\n VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key \\\n -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z \\\n -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n echo \"Adding activation key to the build\"\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n echo \"Pre-registering with subscription manager.\"\n export RETRY_MAX_TRIES=6\n if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"\n then\n echo \"Subscription-manager register failed\"\n exit 1\n fi\n unset RETRY_MAX_TRIES\n trap 'subscription-manager unregister || true' EXIT\n\n # copy generated certificates to /shared volume\n cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e /dev/null; then\n cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n exit 1\n fi\n # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n # (we set the workdir using 'unshare -w')\n context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n # Instrumented builds (SAST) use this step as their base and add some other tools.\n while read -r volume_mount; do\n VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n done \u003c\u003c\u003c \"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n while read -r filename; do\n echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n buildah build\n \"${VOLUME_MOUNTS[@]}\"\n \"${BUILDAH_ARGS[@]}\"\n \"${LABELS[@]}\"\n \"${ANNOTATIONS[@]}\"\n --tls-verify=\"$TLSVERIFY\" --no-cache\n --ulimit nofile=4096:4096\n --http-proxy=false\n -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n # Get the image pullspec and filter out a tag if it is not set\n # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n # if buildah did not use that particular image during build because it was skipped\n if [ -n \"$base_image_digest\" ]; then\n echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e /shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/workspace/source" }, { "computeResources": { "limits": { "cpu": "600m", "memory": "4Gi" }, "requests": { "cpu": "600m", "memory": "4Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "buildah-demo-cddphguiiu-build-container" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"\nthen\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/workspace/source/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"\nthen\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c \"/workspace/source\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n echo -n \"${IMAGE}@\"\n cat \"/workspace/source/image-digest\"\n} \u003e \"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"\nthen\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e /shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e /tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"\n then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/workspace/source" }, { "computeResources": { "limits": { "cpu": "1100m", "memory": "4Gi" }, "requests": { "cpu": "1100m", "memory": "4Gi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\n cyclonedx)\n syft_sbom_type=cyclonedx-json@1.5 ;;\n spdx)\n syft_sbom_type=spdx-json@2.3 ;;\n *)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/workspace/source/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/workspace/source/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/workspace/source/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/workspace/source/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ADDITIONAL_BASE_IMAGES+=(\"$1\"); shift; done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/workspace/source/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/workspace/source/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/workspace/source/sbom-source.json\")\nfi\n\nif [ -f \"/workspace/source/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/workspace/source/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/workspace/source" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"\n then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/workspace/source" } ], "volumes": [ { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "shared" }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } } ], "workspaces": [ { "description": "Workspace containing the source code to build.", "name": "source" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb/records/908293eb-c7dc-4b11-8a2a-13df7acb16a4", "results.tekton.dev/result": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f7c922a491d27ba52d263f5a6f965e7a-f391805a57fff40e-01\"}" }, "creationTimestamp": "2026-05-19T11:25:50Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.3", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-cddphguiiu", "tekton.dev/pipelineRunUID": "959fec55-5f01-42c4-afcd-2665ae90ffbb", "tekton.dev/pipelineTask": "build-image-index", "tekton.dev/task": "build-image-index" }, "name": "buildah-demo-cddphguiiu-build-image-index", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-cddphguiiu", "uid": "959fec55-5f01-42c4-afcd-2665ae90ffbb" } ], "resourceVersion": "64042", "uid": "908293eb-c7dc-4b11-8a2a-13df7acb16a4" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "build-image-index" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:26:33Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:26:33Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-cddphguiiu-build-image-index-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb" }, "entryPoint": "build-image-index", "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index" } }, "results": [ { "name": "IMAGES", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235" }, { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu" } ], "spanContext": { "traceparent": "00-f7c922a491d27ba52d263f5a6f965e7a-f391805a57fff40e-01" }, "startTime": "2026-05-19T11:25:50Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://5db3df8702012ff6e72e53a4a4c55bab7c9ac39e8f8d95e8e4c2b92f38995120", "exitCode": 0, "finishedAt": "2026-05-19T11:26:33Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:26:19Z" }, "terminationReason": "Completed" }, { "container": "step-create-sbom", "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://7d77407fdcd9d6851b2bf3409944997f5afecfd0cbe6bd4ec5b1e3c104c9211a", "exitCode": 0, "finishedAt": "2026-05-19T11:26:33Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:26:21Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://8b174755fe237d5f248e5eedf9c7bdc6fdd7d12dd5de1c7deaa4a04857288dd1", "exitCode": 0, "finishedAt": "2026-05-19T11:26:33Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:26:22Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This takes existing Image Manifests and combines them in an Image Index.", "params": [ { "description": "The target image and tag where the image will be pushed to.", "name": "IMAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "description": "List of Image Manifests to be referenced by the Image Index", "name": "IMAGES", "type": "array" }, { "default": "true", "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.", "name": "ALWAYS_BUILD_INDEX", "type": "string" }, { "default": "vfs", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": "false", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "List of all referenced image manifests", "name": "IMAGES", "type": "string" }, { "description": "Image reference of the built image containing both the repository and the digest", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "vfs" } ], "volumeMounts": [ { "mountPath": "/index-build-data", "name": "shared-dir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235" ], "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "cpu": "250m", "memory": "4Gi" } }, "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n --image \"$IMAGE\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --buildah-format \"$BUILDAH_FORMAT\" \\\n --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n --additional-tags \"buildah-demo-cddphguiiu-build-image-index\" \\\n --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n --result-path-images \"/tekton/results/IMAGES\" \\\n --images \"$@\"; then\n echo \"Failed to build image index\"\n exit 1\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-index\n --index-image-pullspec \"$IMAGE_URL\"\n --index-image-digest \"$IMAGE_DIGEST\"\n --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n" }, { "computeResources": { "limits": { "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 } } ], "volumes": [ { "emptyDir": {}, "name": "shared-dir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-e6844c1a76", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb/records/3abdd7e5-a152-412b-a712-db50d1777083", "results.tekton.dev/result": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f7c922a491d27ba52d263f5a6f965e7a-b2f191061b144929-01\"}" }, "creationTimestamp": "2026-05-19T11:23:10Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-cddphguiiu", "tekton.dev/pipelineRunUID": "959fec55-5f01-42c4-afcd-2665ae90ffbb", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone" }, "name": "buildah-demo-cddphguiiu-clone-repository", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-cddphguiiu", "uid": "959fec55-5f01-42c4-afcd-2665ae90ffbb" } ], "resourceVersion": "56170", "uid": "3abdd7e5-a152-412b-a712-db50d1777083" }, "spec": { "params": [ { "name": "url", "value": "https://github.com/conforma/golden-container.git" }, { "name": "revision", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "git-clone" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1@sha256:7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "output", "persistentVolumeClaim": { "claimName": "app-studio-default-workspace" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:23:23Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:23:23Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-cddphguiiu-clone-repository-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21" }, "entryPoint": "git-clone", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "be3214825d8af1a44d1406df6233660e8372d26f" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://github.com/conforma/golden-container.git" }, { "name": "commit", "type": "string", "value": "be3214825d8af1a44d1406df6233660e8372d26f" }, { "name": "commit-timestamp", "type": "string", "value": "1775533888" }, { "name": "short-commit", "type": "string", "value": "be32148" }, { "name": "url", "type": "string", "value": "https://github.com/conforma/golden-container.git" } ], "spanContext": { "traceparent": "00-f7c922a491d27ba52d263f5a6f965e7a-b2f191061b144929-01" }, "startTime": "2026-05-19T11:23:10Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "provenance": {}, "terminated": { "containerID": "cri-o://44ec28fba9af36387ad0c56b451f35c212617956dec0a43df1b6a52e9771814b", "exitCode": 0, "finishedAt": "2026-05-19T11:23:22Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1},{\"key\":\"commit\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1775533888\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"be32148\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:23:22Z" }, "terminationReason": "Completed" }, { "container": "step-symlink-check", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "provenance": {}, "terminated": { "containerID": "cri-o://c80e0e7e0f80c7e7b934c55c0ad8422917a5dc0c340edffba9a257aace692057", "exitCode": 0, "finishedAt": "2026-05-19T11:23:23Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1},{\"key\":\"commit\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1775533888\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"be32148\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:23:23Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone Task will clone a repo from the provided url into the output Workspace. By default the repo will be cloned into the root of your Workspace.", "params": [ { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n", "name": "submodulePaths", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "7", "description": "Length of short commit SHA", "name": "shortCommitLength", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "source", "description": "Subdirectory inside the `output` Workspace to clone the repo into.", "name": "subdirectory", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Clean out the contents of the destination directory if it already exists before cloning.", "name": "deleteExisting", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "false", "description": "Log the commands that are executed during `git-clone`'s operation.", "name": "verbose", "type": "string" }, { "default": "", "description": "Deprecated. Has no effect. Will be removed in the future.", "name": "gitInitImage", "type": "string" }, { "default": "/tekton/home", "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n", "name": "userHome", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" } ], "steps": [ { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "PARAM_URL", "value": "https://github.com/conforma/golden-container.git" }, { "name": "PARAM_REVISION" }, { "name": "PARAM_REFSPEC" }, { "name": "PARAM_SUBMODULES", "value": "true" }, { "name": "PARAM_SUBMODULE_PATHS" }, { "name": "PARAM_DEPTH", "value": "1" }, { "name": "PARAM_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "PARAM_SSL_VERIFY", "value": "true" }, { "name": "PARAM_SUBDIRECTORY", "value": "source" }, { "name": "PARAM_DELETE_EXISTING", "value": "true" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "PARAM_VERBOSE", "value": "false" }, { "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "PARAM_USER_HOME", "value": "/tekton/home" }, { "name": "PARAM_FETCH_TAGS", "value": "false" }, { "name": "PARAM_GIT_INIT_IMAGE" }, { "name": "PARAM_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "PARAM_TARGET_BRANCH", "value": "main" }, { "name": "PARAM_MERGE_SOURCE_REPO_URL" }, { "name": "PARAM_MERGE_SOURCE_DEPTH" }, { "name": "WORKSPACE_OUTPUT_PATH", "value": "/workspace/output" }, { "name": "WORKSPACE_SSH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_SSH_DIRECTORY_PATH" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ] ; then\n set -x\nfi\n\nif [ -n \"${PARAM_GIT_INIT_IMAGE}\" ]; then\n echo \"WARNING: provided deprecated gitInitImage parameter has no effect.\"\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n # Compatibility with kubernetes.io/basic-auth secrets\n elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e \"${PARAM_USER_HOME}/.git-credentials\"\n echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n helper = store\" \u003e \"${PARAM_USER_HOME}/.gitconfig\"\n else\n echo \"Unknown basic-auth workspace format\"\n exit 1\n fi\n chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\n\ncleandir() {\n # Delete any existing contents of the repo directory if it exists.\n #\n # We don't just \"rm -rf ${CHECKOUT_DIR}\" because ${CHECKOUT_DIR} might be \"/\"\n # or the root of a mounted volume.\n if [ -d \"${CHECKOUT_DIR}\" ] ; then\n # Delete non-hidden files and directories\n rm -rf \"${CHECKOUT_DIR:?}\"/*\n # Delete files and directories starting with . but excluding ..\n rm -rf \"${CHECKOUT_DIR}\"/.[!.]*\n # Delete files and directories starting with .. plus any other character\n rm -rf \"${CHECKOUT_DIR}\"/..?*\n fi\n}\n\nif [ \"${PARAM_DELETE_EXISTING}\" = \"true\" ] ; then\n cleandir\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n -url=\"${PARAM_URL}\" \\\n -revision=\"${PARAM_REVISION}\" \\\n -refspec=\"${PARAM_REFSPEC}\" \\\n -path=\"${CHECKOUT_DIR}\" \\\n -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n -submodules=\"${PARAM_SUBMODULES}\" \\\n -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n -depth=\"${PARAM_DEPTH}\" \\\n -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n # Determine if merging from a different repository or the same one\n if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n normalize_url() {\n echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n }\n\n NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n MERGE_REMOTE=\"origin\"\n else\n echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n echo \"Adding remote 'merge-source'...\"\n git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n MERGE_REMOTE=\"merge-source\"\n fi\n else\n echo \"Merging from the same repository (origin)\"\n MERGE_REMOTE=\"origin\"\n fi\n\n echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n else\n retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n fi\n\n\n echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n git config --global user.email \"tekton-git-clone@tekton.dev\"\n git config --global user.name \"Tekton Git Clone Task\"\n\nif ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n echo \"--- Git Status ---\"\n git status\n echo \"------------------\"\n exit 1\nfi\n\n# Check if there are changes staged for commit\nif git diff --staged --quiet; then\n echo \"No diff was found, skipping merge...\" \u003e\u00262\nelse\n echo \"Merge successful (no conflicts found), committing...\"\nif ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n exit 1\nfi\n MERGED_SHA=$(git rev-parse HEAD)\n echo \"New HEAD after merge: ${MERGED_SHA}\"\n echo \"${MERGED_SHA}\" \u003e \"/tekton/results/merged_sha\"\nfi\n\nelse\n echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e \"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e \"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ] ; then\n echo \"Fetching tags\"\n retry git fetch --tags\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, { "computeResources": {}, "env": [ { "name": "PARAM_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "PARAM_SUBDIRECTORY", "value": "source" }, { "name": "WORKSPACE_OUTPUT_PATH", "value": "/workspace/output" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\ncheck_symlinks() {\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n while read -r symlink\n do\n target=$(readlink -m \"$symlink\")\n if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n fi\n done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ] ; then\n return 1\n fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ] ; then\n echo \"Running symlink check\"\n check_symlinks\nfi\n" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The git repo will be cloned onto the volume backing this Workspace.", "name": "output" }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true }, { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb/records/70ff452b-30be-49c0-bbff-59a9958fbd6b", "results.tekton.dev/result": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f7c922a491d27ba52d263f5a6f965e7a-e21c48b605228ca3-01\"}" }, "creationTimestamp": "2026-05-19T11:22:48Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.4.2", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-cddphguiiu", "tekton.dev/pipelineRunUID": "959fec55-5f01-42c4-afcd-2665ae90ffbb", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init" }, "name": "buildah-demo-cddphguiiu-init", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-cddphguiiu", "uid": "959fec55-5f01-42c4-afcd-2665ae90ffbb" } ], "resourceVersion": "55307", "uid": "70ff452b-30be-49c0-bbff-59a9958fbd6b" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:23:09Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:23:09Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-cddphguiiu-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "spanContext": { "traceparent": "00-f7c922a491d27ba52d263f5a6f965e7a-e21c48b605228ca3-01" }, "startTime": "2026-05-19T11:22:48Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "init", "provenance": {}, "terminated": { "containerID": "cri-o://fedf78cf32bec3fae09472223975a4ec3fdc20ef2811e4e941befa1026161114", "exitCode": 0, "finishedAt": "2026-05-19T11:23:09Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:23:08Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-e6844c1a76", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb/records/f5a32137-a612-48e0-86d2-b4611bc039b5", "results.tekton.dev/result": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f7c922a491d27ba52d263f5a6f965e7a-9cccbcc8a1d9a4bd-01\"}" }, "creationTimestamp": "2026-05-19T11:23:24Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.3.2", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-cddphguiiu", "tekton.dev/pipelineRunUID": "959fec55-5f01-42c4-afcd-2665ae90ffbb", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies" }, "name": "buildah-demo-cddphguiiu-prefetch-dependencies", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-cddphguiiu", "uid": "959fec55-5f01-42c4-afcd-2665ae90ffbb" } ], "resourceVersion": "57391", "uid": "f5a32137-a612-48e0-86d2-b4611bc039b5" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies:0.3@sha256:214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "source", "persistentVolumeClaim": { "claimName": "app-studio-default-workspace" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:23:45Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:23:45Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-cddphguiiu-prefetch-dependencies-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f" }, "entryPoint": "prefetch-dependencies", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies" } }, "spanContext": { "traceparent": "00-f7c922a491d27ba52d263f5a6f965e7a-9cccbcc8a1d9a4bd-01" }, "startTime": "2026-05-19T11:23:24Z", "steps": [ { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "provenance": {}, "terminated": { "containerID": "cri-o://ad18c24394f58eab9dcb68c1e379e105fb6da9eeaaca5c5cd0bf75e301c0098b", "exitCode": 0, "finishedAt": "2026-05-19T11:23:44Z", "reason": "Completed", "startedAt": "2026-05-19T11:23:41Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "1", "memory": "3Gi" }, "requests": { "cpu": "1", "memory": "3Gi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/workspace/source/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/workspace/source/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/workspace/source/cachi2/cachi2.env /workspace/source/cachi2/prefetch.env /workspace/source/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" } ], "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e /mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ] } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "emptyDir": {}, "name": "config" } ], "workspaces": [ { "description": "Workspace with the source code, prefetch artifacts will be stored on the workspace as well", "name": "source" }, { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-e6844c1a76", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb/records/b39d0ed4-f69e-46cf-a10d-9b4f5754fec4", "results.tekton.dev/result": "chains-e2e-rqft/results/959fec55-5f01-42c4-afcd-2665ae90ffbb", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, appstudio", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f7c922a491d27ba52d263f5a6f965e7a-f5332f55993e7098-01\"}" }, "creationTimestamp": "2026-05-19T11:26:33Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.3.1", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-cddphguiiu", "tekton.dev/pipelineRunUID": "959fec55-5f01-42c4-afcd-2665ae90ffbb", "tekton.dev/pipelineTask": "push-dockerfile", "tekton.dev/task": "push-dockerfile" }, "name": "buildah-demo-cddphguiiu-push-dockerfile", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-cddphguiiu", "uid": "959fec55-5f01-42c4-afcd-2665ae90ffbb" } ], "resourceVersion": "64532", "uid": "b39d0ed4-f69e-46cf-a10d-9b4f5754fec4" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu" }, { "name": "IMAGE_DIGEST", "value": "sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235" }, { "name": "DOCKERFILE", "value": "Containerfile" }, { "name": "CONTEXT", "value": "." } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "push-dockerfile" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile:0.3@sha256:359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "workspace", "persistentVolumeClaim": { "claimName": "app-studio-default-workspace" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:26:45Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:26:45Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-cddphguiiu-push-dockerfile-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7" }, "entryPoint": "push-dockerfile", "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile" } }, "results": [ { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images@sha256:67ef5c3f3ed899052a5b4167080f09b0fa1eb7a479fb982c630383d565ae5537" } ], "spanContext": { "traceparent": "00-f7c922a491d27ba52d263f5a6f965e7a-f5332f55993e7098-01" }, "startTime": "2026-05-19T11:26:34Z", "steps": [ { "container": "step-push", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://c206ced145d1d690e23d1ea3da666896778bc6aff6e81ee63e3bfa375412d998", "exitCode": 0, "finishedAt": "2026-05-19T11:26:45Z", "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:67ef5c3f3ed899052a5b4167080f09b0fa1eb7a479fb982c630383d565ae5537\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:26:44Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.", "params": [ { "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.", "name": "IMAGE", "type": "string" }, { "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile.", "name": "DOCKERFILE", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": ".dockerfile", "description": "Suffix of the Dockerfile image tag.", "name": "TAG_SUFFIX", "type": "string" }, { "default": "application/vnd.konflux.dockerfile", "description": "Artifact type of the Dockerfile image.", "name": "ARTIFACT_TYPE", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "info", "description": "Log level to use in the task. See golang logrus docs for available levels.", "name": "LOG_LEVEL", "type": "string" } ], "results": [ { "description": "Digest-pinned image reference to the Dockerfile image.", "name": "IMAGE_REF", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "args": [ "--source", "source", "--context", ".", "--containerfile", "Containerfile", "--image-url", "quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu", "--image-digest", "sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235", "--artifact-type", "application/vnd.konflux.dockerfile", "--tag-suffix", ".dockerfile", "--result-path-image-ref", "/tekton/results/IMAGE_REF", "--alternative-filename", "Dockerfile" ], "command": [ "konflux-build-cli", "image", "push-containerfile" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "push", "workingDir": "/workspace/workspace" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "Workspace containing the source code from where the Dockerfile is discovered.", "name": "workspace" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/4a1280ac-2a5f-4cd9-b07d-a62da40580a2/records/66b8f445-a6aa-407f-8066-8b90f969a876", "results.tekton.dev/result": "chains-e2e-rqft/results/4a1280ac-2a5f-4cd9-b07d-a62da40580a2", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-bdd0db4810eb90d3a70d88a5974180d2-a257d376d40dfd7e-01\"}" }, "creationTimestamp": "2026-05-19T11:26:49Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run-76jht", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-76jht", "tekton.dev/pipelineRunUID": "4a1280ac-2a5f-4cd9-b07d-a62da40580a2", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-76jht-verify-enterprise-contract", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-76jht", "uid": "4a1280ac-2a5f-4cd9-b07d-a62da40580a2" } ], "resourceVersion": "65788", "uid": "66b8f445-a6aa-407f-8066-8b90f969a876" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/cosign-public-key" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:27:44Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:27:44Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-bfe152b08d84e239299a5b4916b6d383-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779190045\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n" } ], "spanContext": { "traceparent": "00-bdd0db4810eb90d3a70d88a5974180d2-a257d376d40dfd7e-01" }, "startTime": "2026-05-19T11:26:49Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://58657e181e2b60c0eb209e1cf793394b9b6306724ffee90c006d7d8dd5d8a4e7", "exitCode": 0, "finishedAt": "2026-05-19T11:27:43Z", "reason": "Completed", "startedAt": "2026-05-19T11:27:18Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://fcfcd6fc122a710fbc9f643d16d49cdbd88bf9ea8eaf36c37f8187f88f1e6564", "exitCode": 0, "finishedAt": "2026-05-19T11:27:43Z", "reason": "Completed", "startedAt": "2026-05-19T11:27:19Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://858cbcdad58bd4ae2f1e0a4284ebb659884374b74b2763ad8601ec8f1d577070", "exitCode": 0, "finishedAt": "2026-05-19T11:27:43Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190045\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:27:19Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://23ca7a614ecdcf253552199e8dc9cbac93cefc13411953c6b821e855e79d39b8", "exitCode": 0, "finishedAt": "2026-05-19T11:27:43Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190045\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:27:26Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://fbcc09df3863ebd8d336a5f1862614b09d486ab899d9c7e005e05756857d4551", "exitCode": 0, "finishedAt": "2026-05-19T11:27:43Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190045\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:27:26Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://8fd98a63f7d0b0f3a5d90ca3733453d8c85f2eaae32573e2e367491d1a512231", "exitCode": 0, "finishedAt": "2026-05-19T11:27:43Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190045\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:27:26Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://35a8cee22f1194dd30f062a57b52a5ab90b0565fe0bea0bb0edddefd1506a863", "exitCode": 0, "finishedAt": "2026-05-19T11:27:43Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190045\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:27:27Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://fc2692c3b4d189d0f7be23ef0cf77a6ddab841d19345d65f696a5fb0c735868b", "exitCode": 0, "finishedAt": "2026-05-19T11:27:43Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190045\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:27:27Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://c07d3f117678dbba8b3337a673265905f8ccd17cbd1dfb35452b6a087c7f3e87", "exitCode": 0, "finishedAt": "2026-05-19T11:27:43Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190045\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:27:27Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/cosign-public-key" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/d8a21c75-0134-4c4f-9269-0000708731bf/records/89bafd8d-e2d6-4e89-9792-18afeb066c4a", "results.tekton.dev/result": "chains-e2e-rqft/results/d8a21c75-0134-4c4f-9269-0000708731bf", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d32eb9e2b1624b7e307c0881be49413b-3b948285428cb43f-01\"}" }, "creationTimestamp": "2026-05-19T11:29:05Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run-d7z5f", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-d7z5f", "tekton.dev/pipelineRunUID": "d8a21c75-0134-4c4f-9269-0000708731bf", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-d7z5f-verify-enterprise-contract", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-d7z5f", "uid": "d8a21c75-0134-4c4f-9269-0000708731bf" } ], "resourceVersion": "70057", "uid": "89bafd8d-e2d6-4e89-9792-18afeb066c4a" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}},{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/golden-image-public-keynasaqjhroo" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:29:25Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:29:25Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-c4e3bc9aed2b4d2fd9d625b53b90bc04-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779190163\",\"namespace\":\"\",\"successes\":84,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n" } ], "spanContext": { "traceparent": "00-d32eb9e2b1624b7e307c0881be49413b-3b948285428cb43f-01" }, "startTime": "2026-05-19T11:29:05Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://7ad0eca72760c21cdb5825fd14bba16e01ccbc9388a6360a35a66203d7b13480", "exitCode": 0, "finishedAt": "2026-05-19T11:29:13Z", "reason": "Completed", "startedAt": "2026-05-19T11:29:13Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://d62ed6eecea9aea1636975d84bf11a908acf0ed67aa0e8cdb048845166c64d7e", "exitCode": 0, "finishedAt": "2026-05-19T11:29:13Z", "reason": "Completed", "startedAt": "2026-05-19T11:29:13Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://9ab3dba12503710e99d2a2028b774c86841c005d5307ecdfb6b5cd2f665f0a93", "exitCode": 0, "finishedAt": "2026-05-19T11:29:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190163\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:14Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://653dce0884ca6d6c6a7097f2766ca4853dafb23e2c2c4523100ae12a979e71f3", "exitCode": 0, "finishedAt": "2026-05-19T11:29:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190163\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:23Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://42f912970264e9695a554113e120522b6442bac0d9831a9d724278673b2fe2a5", "exitCode": 0, "finishedAt": "2026-05-19T11:29:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190163\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:23Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://8306e3e48567764af31b8e01913e190528cedf3beab783a49be5390e83eb765d", "exitCode": 0, "finishedAt": "2026-05-19T11:29:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190163\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:24Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://bfd84f6cdad8d00605927301022ce3f6e97ecad21f9df6efaf7a77202844108a", "exitCode": 0, "finishedAt": "2026-05-19T11:29:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190163\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:24Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://10c0653ec8148a704af962c19c7a0c2b9cdd6d66b138e22ade4de8492b6c38ca", "exitCode": 0, "finishedAt": "2026-05-19T11:29:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190163\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:24Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://3a625e544e2f879db72e1f7925380b2de5564e4728713743178b65d7bb921c3c", "exitCode": 0, "finishedAt": "2026-05-19T11:29:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190163\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:24Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}},{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/golden-image-public-keynasaqjhroo" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/4f36497b-3d91-40ee-9b0e-a3db3c29b176/records/622e1406-10fd-49ee-9f88-ea575c58a583", "results.tekton.dev/result": "chains-e2e-rqft/results/4f36497b-3d91-40ee-9b0e-a3db3c29b176", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-94a09aba7bed27ccd71117e91a3536df-d3108f41942b6e8a-01\"}" }, "creationTimestamp": "2026-05-19T11:28:20Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run-dczwd", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-dczwd", "tekton.dev/pipelineRunUID": "4f36497b-3d91-40ee-9b0e-a3db3c29b176", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-dczwd-verify-enterprise-contract", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-dczwd", "uid": "4f36497b-3d91-40ee-9b0e-a3db3c29b176" } ], "resourceVersion": "67962", "uid": "622e1406-10fd-49ee-9f88-ea575c58a583" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/cosign-public-key" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:28:36Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:28:36Z", "message": "\"step-assert\" exited with code 1: Error", "reason": "StepFailed", "status": "False", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-be9404710cdece5c1de743e6e531a3c2-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779190114\",\"namespace\":\"\",\"successes\":5,\"failures\":1,\"warnings\":0,\"result\":\"FAILURE\"}\n" } ], "spanContext": { "traceparent": "00-94a09aba7bed27ccd71117e91a3536df-d3108f41942b6e8a-01" }, "startTime": "2026-05-19T11:28:20Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://bec2f82293b0500346ecaeabfc70ab8fdf1efe6e9a622a947182c21023b308be", "exitCode": 0, "finishedAt": "2026-05-19T11:28:27Z", "reason": "Completed", "startedAt": "2026-05-19T11:28:27Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://8b9c27ae89a038b0fedeead99155adb5ca22206942757b1975d7b619ed47093c", "exitCode": 0, "finishedAt": "2026-05-19T11:28:27Z", "reason": "Completed", "startedAt": "2026-05-19T11:28:27Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://732679bc675092b231f3613506af105340954f7ae1dcd5705ad0094410e83ca6", "exitCode": 0, "finishedAt": "2026-05-19T11:28:34Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190114\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:28Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://a1297f6a1a285ff38778c208de53cf9883d292237568172a9ed2972b663544db", "exitCode": 0, "finishedAt": "2026-05-19T11:28:34Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190114\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:34Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://83a8c3eab475f63f753f6465d101bdd4a406ab3fa9c43698ffb95d951a8b49f6", "exitCode": 0, "finishedAt": "2026-05-19T11:28:34Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190114\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:34Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://2b11b55a93e213b3fb4f6cde869078d34549a77967b25e20e848a380da96772c", "exitCode": 0, "finishedAt": "2026-05-19T11:28:35Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190114\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:34Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://75c8f8eb646b49b84f8bf713985070865c4d8de0de00bf4e0d4b99d025cb2fa4", "exitCode": 0, "finishedAt": "2026-05-19T11:28:35Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190114\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:35Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://6439dfc8a6f33d410b2f33eeae8b0ec30cbe994167dc68f2528dbd78ed6cfee3", "exitCode": 0, "finishedAt": "2026-05-19T11:28:35Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190114\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:35Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://1dd7c78eb7f4851bfc66759b2956d3ebbca964c24f7badd7f694824822b5b4ed", "exitCode": 1, "finishedAt": "2026-05-19T11:28:35Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190114\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Error", "startedAt": "2026-05-19T11:28:35Z" }, "terminationReason": "Error" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/cosign-public-key" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/4f547f4b-b632-4546-860c-faa73aa38e1c/records/53606017-81a3-44ce-b477-128e374a89d0", "results.tekton.dev/result": "chains-e2e-rqft/results/4f547f4b-b632-4546-860c-faa73aa38e1c", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-483f3843ad480efda85a468a7c25bd24-bdce205116004e60-01\"}" }, "creationTimestamp": "2026-05-19T11:29:26Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run-mdbwl", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-mdbwl", "tekton.dev/pipelineRunUID": "4f547f4b-b632-4546-860c-faa73aa38e1c", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-mdbwl-verify-enterprise-contract", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-mdbwl", "uid": "4f547f4b-b632-4546-860c-faa73aa38e1c" } ], "resourceVersion": "71064", "uid": "53606017-81a3-44ce-b477-128e374a89d0" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/golden-image-public-keygdgtyapdmy" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:29:55Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:29:55Z", "message": "\"step-assert\" exited with code 1: Error", "reason": "StepFailed", "status": "False", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-f46156bcad3f7ae08da5e01e04834fda-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779190194\",\"namespace\":\"\",\"successes\":405,\"failures\":3,\"warnings\":27,\"result\":\"FAILURE\"}\n" } ], "spanContext": { "traceparent": "00-483f3843ad480efda85a468a7c25bd24-bdce205116004e60-01" }, "startTime": "2026-05-19T11:29:27Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://ed671a76d34608c5f8c9f0c3b07cc20f4ffa4c7b910fffe797165a546828e851", "exitCode": 0, "finishedAt": "2026-05-19T11:29:32Z", "reason": "Completed", "startedAt": "2026-05-19T11:29:32Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://40a73d0fad2476bd9e62b59de2efade67dfb6f6a79a48170845bc8f9384d5d0a", "exitCode": 0, "finishedAt": "2026-05-19T11:29:32Z", "reason": "Completed", "startedAt": "2026-05-19T11:29:32Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://6ffb9f76b8d195bcdd9b9370ad00fd308db4341cb5fd08cf0e1f7ae7ac5ce6a0", "exitCode": 0, "finishedAt": "2026-05-19T11:29:54Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190194\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":405,\\\"failures\\\":3,\\\"warnings\\\":27,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:32Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://6c9c04463c65456af7ba70c39092cbe9f4a44c507e07eb3e86fde76f713064ce", "exitCode": 0, "finishedAt": "2026-05-19T11:29:54Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190194\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":405,\\\"failures\\\":3,\\\"warnings\\\":27,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:54Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://a314b36fcf34c373324429349a49d492f76085c8467e66083fce1169d77a72e9", "exitCode": 0, "finishedAt": "2026-05-19T11:29:54Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190194\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":405,\\\"failures\\\":3,\\\"warnings\\\":27,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:54Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://be248dbff3d15ac094034712a48c1c0cf2063160096ef480f3a28ea14eb2272e", "exitCode": 0, "finishedAt": "2026-05-19T11:29:54Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190194\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":405,\\\"failures\\\":3,\\\"warnings\\\":27,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:54Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://4ee381117a4dd27599e3ce23c6a72661843879092876afe98548eca0306a2ee4", "exitCode": 0, "finishedAt": "2026-05-19T11:29:54Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190194\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":405,\\\"failures\\\":3,\\\"warnings\\\":27,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:54Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://fb9fb517027b3ba58a73f90771ea598724d8dbe859e965002887f8bedb9d6a17", "exitCode": 0, "finishedAt": "2026-05-19T11:29:55Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190194\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":405,\\\"failures\\\":3,\\\"warnings\\\":27,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:55Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://1ae661a5a8f5cacffd8eafe0e712df78b424a99e2efa16a1fd1a79544f8e6d93", "exitCode": 1, "finishedAt": "2026-05-19T11:29:55Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190194\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":405,\\\"failures\\\":3,\\\"warnings\\\":27,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Error", "startedAt": "2026-05-19T11:29:55Z" }, "terminationReason": "Error" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/golden-image-public-keygdgtyapdmy" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/afc224cf-d413-4fc0-ad46-366e32067dec/records/06983ee1-de36-4a5e-894c-877cd904c659", "results.tekton.dev/result": "chains-e2e-rqft/results/afc224cf-d413-4fc0-ad46-366e32067dec", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a344bbe59c089604a7dd6be9fdbada83-556ec5889571f02e-01\"}" }, "creationTimestamp": "2026-05-19T11:28:50Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run-qv7tr", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-qv7tr", "tekton.dev/pipelineRunUID": "afc224cf-d413-4fc0-ad46-366e32067dec", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-qv7tr-verify-enterprise-contract", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-qv7tr", "uid": "afc224cf-d413-4fc0-ad46-366e32067dec" } ], "resourceVersion": "69121", "uid": "06983ee1-de36-4a5e-894c-877cd904c659" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/cosign-public-key" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:29:04Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:29:04Z", "message": "\"step-assert\" exited with code 1: Error", "reason": "StepFailed", "status": "False", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-f8f2cf9d9a639cf23d42a63b4f5ddfcf-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779190142\",\"namespace\":\"\",\"successes\":0,\"failures\":6,\"warnings\":0,\"result\":\"FAILURE\"}\n" } ], "spanContext": { "traceparent": "00-a344bbe59c089604a7dd6be9fdbada83-556ec5889571f02e-01" }, "startTime": "2026-05-19T11:28:50Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://961189e3d97a49348404d9b47095930fbf82441b4bb40764628bdb4f3310f654", "exitCode": 0, "finishedAt": "2026-05-19T11:28:56Z", "reason": "Completed", "startedAt": "2026-05-19T11:28:56Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://8a6e2b51a24d8f7b3ec7b56b8ac530e7fcecac75bbdf4f63cb924339c3bc199b", "exitCode": 0, "finishedAt": "2026-05-19T11:28:56Z", "reason": "Completed", "startedAt": "2026-05-19T11:28:56Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://8f1d72201c67cbcd5c3681c584b8b155f2407fa2469f0bd27e132678938cc10c", "exitCode": 0, "finishedAt": "2026-05-19T11:29:02Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190142\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:56Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://91b035d09c4a1d9c53c6f15b92cc0216cf75e28844e9a0d09ecfcd2f5b95040c", "exitCode": 0, "finishedAt": "2026-05-19T11:29:03Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190142\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:03Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://e7f394538bd5b1b9552a112c1555be3a46c4981263a7accbb382d887bf028890", "exitCode": 0, "finishedAt": "2026-05-19T11:29:03Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190142\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:03Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://724da637f743984608ab5b015fd165f501e8d8aba14532659d8141a3151ab0ed", "exitCode": 0, "finishedAt": "2026-05-19T11:29:03Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190142\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:03Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://e0d9249dc6cddae20cffb2e18763a6aba74c824f50ce7bb0a2acb08f4a2b1202", "exitCode": 0, "finishedAt": "2026-05-19T11:29:03Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190142\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:03Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://64fc332b9f665367b5a5217ba55a051ad4c6e7729df991717bf581127c4fe801", "exitCode": 0, "finishedAt": "2026-05-19T11:29:03Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190142\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:29:03Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://f9c710154347436917b15c71c6f59e664a6276d9343e1dbb9ca85e6567a6d713", "exitCode": 1, "finishedAt": "2026-05-19T11:29:04Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190142\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Error", "startedAt": "2026-05-19T11:29:03Z" }, "terminationReason": "Error" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/cosign-public-key" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/9c1d4187-ef79-4157-a3fa-4e887c216d49/records/6519a3fc-89a0-4390-b7ad-88e9bcedd12d", "results.tekton.dev/result": "chains-e2e-rqft/results/9c1d4187-ef79-4157-a3fa-4e887c216d49", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-f23eddca957e4d530415211666abdde2-3416640484f9dc4b-01\"}" }, "creationTimestamp": "2026-05-19T11:27:45Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run-thvxg", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-thvxg", "tekton.dev/pipelineRunUID": "9c1d4187-ef79-4157-a3fa-4e887c216d49", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-thvxg-verify-enterprise-contract", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-thvxg", "uid": "9c1d4187-ef79-4157-a3fa-4e887c216d49" } ], "resourceVersion": "66836", "uid": "6519a3fc-89a0-4390-b7ad-88e9bcedd12d" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/cosign-public-key" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "false" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:28:18Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:28:18Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-8368f1b730644e7aa096b8ae52819678-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779190096\",\"namespace\":\"\",\"successes\":5,\"failures\":1,\"warnings\":0,\"result\":\"FAILURE\"}\n" } ], "spanContext": { "traceparent": "00-f23eddca957e4d530415211666abdde2-3416640484f9dc4b-01" }, "startTime": "2026-05-19T11:27:45Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://fecbb7246929f65fa2d4eaea89629ef8e70d142fbbed162a5e97bae1fa2a1c8c", "exitCode": 0, "finishedAt": "2026-05-19T11:28:10Z", "reason": "Completed", "startedAt": "2026-05-19T11:28:10Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://0f8db6793dad64c8830b3cf955513c0590e26397607ba71463de9efac6e0d3ea", "exitCode": 0, "finishedAt": "2026-05-19T11:28:10Z", "reason": "Completed", "startedAt": "2026-05-19T11:28:10Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://3c6739372562a6c55f75a08dcd23fa4bd5e181eff488905faef16008d1cdbedc", "exitCode": 0, "finishedAt": "2026-05-19T11:28:16Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190096\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:10Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://5f293f6e336f4fc38147004a53b5a675c46b37693eabf317d6c36bea668afe98", "exitCode": 0, "finishedAt": "2026-05-19T11:28:16Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190096\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:16Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://db5eccb261792fa9445d19b997ca1eefe53f04c5a2d75ceea64bb2aa69f363e8", "exitCode": 0, "finishedAt": "2026-05-19T11:28:16Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190096\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:16Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://fb14f76be93bc005af25744e67023f423bb9a8359e71d7e69e77ed2963160c47", "exitCode": 0, "finishedAt": "2026-05-19T11:28:17Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190096\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:16Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://bf13ab1f1c982cde31e4c86803cf022519e44a274f14f0c1073c6c4c38b442f6", "exitCode": 0, "finishedAt": "2026-05-19T11:28:17Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190096\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:17Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://bc82f5f8e2121570570465fb88eda5bb29158baced9eab8dbc0b1a72cff39269", "exitCode": 0, "finishedAt": "2026-05-19T11:28:17Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190096\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:17Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://7c468be2f71cdca74a421b572895bca2619cee6564770cb7767ee33ae9e7b82b", "exitCode": 0, "finishedAt": "2026-05-19T11:28:17Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190096\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:17Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/cosign-public-key" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "false", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-rqft/results/4837b087-0812-4f65-ab64-c440b9477137/records/caa5519d-f02f-4d4d-a779-6046bcd49c73", "results.tekton.dev/result": "chains-e2e-rqft/results/4837b087-0812-4f65-ab64-c440b9477137", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-950c30c8794d9191acde63d3cf95f3c9-0a398bdd74202924-01\"}" }, "creationTimestamp": "2026-05-19T11:28:37Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run-wggld", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-wggld", "tekton.dev/pipelineRunUID": "4837b087-0812-4f65-ab64-c440b9477137", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-wggld-verify-enterprise-contract", "namespace": "chains-e2e-rqft", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-wggld", "uid": "4837b087-0812-4f65-ab64-c440b9477137" } ], "resourceVersion": "68414", "uid": "caa5519d-f02f-4d4d-a779-6046bcd49c73" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/dummy-public-key-qqrbdhadkt" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:28:49Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:28:49Z", "message": "\"step-assert\" exited with code 1: Error", "reason": "StepFailed", "status": "False", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-5e9be7c3bbcc7c990b5380425ac4ea79-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779190127\",\"namespace\":\"\",\"successes\":0,\"failures\":2,\"warnings\":0,\"result\":\"FAILURE\"}\n" } ], "spanContext": { "traceparent": "00-950c30c8794d9191acde63d3cf95f3c9-0a398bdd74202924-01" }, "startTime": "2026-05-19T11:28:37Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://d56f04ce0e00ea90c7605c363507b1f082b9d941dfe32cb3bd9ec40b780de0cc", "exitCode": 0, "finishedAt": "2026-05-19T11:28:43Z", "reason": "Completed", "startedAt": "2026-05-19T11:28:43Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://7789977fc3675891809092efdcc1a7d6bfecfc0f1935e37410c50b9633f15d2a", "exitCode": 0, "finishedAt": "2026-05-19T11:28:43Z", "reason": "Completed", "startedAt": "2026-05-19T11:28:43Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://08739c451c983a1107768bc7573288d59ad768c8c3f118f79ea248ab18ebfb04", "exitCode": 0, "finishedAt": "2026-05-19T11:28:47Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190127\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:43Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://48e5be4074d6e5672534fe55a52bcca2047832ab7da44b7fb6df42f39556e82f", "exitCode": 0, "finishedAt": "2026-05-19T11:28:47Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190127\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:47Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://cca89049ed2e655e1eb44113311e3557764047cebd463e7ed42191914cb1b404", "exitCode": 0, "finishedAt": "2026-05-19T11:28:48Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190127\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:47Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://e49358632954178d8300017afd43328ac68b7f3c3957e46b3f54ad4bd4bdf470", "exitCode": 0, "finishedAt": "2026-05-19T11:28:48Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190127\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:48Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://b6d9cb0ac8a35486d497cfdd15699fef3b72d5defff53842ff54fefff87c7fe4", "exitCode": 0, "finishedAt": "2026-05-19T11:28:48Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190127\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:48Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://91f4797ea37f57f89f1e54a6812b5ee311447b8e5a8f5d9df7840eaf74253f28", "exitCode": 0, "finishedAt": "2026-05-19T11:28:48Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190127\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:28:48Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://1ea0e231e9ed664582f5d81d68cf9823912165f886544d0cb4fa715e8985fe0f", "exitCode": 1, "finishedAt": "2026-05-19T11:28:49Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190127\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Error", "startedAt": "2026-05-19T11:28:48Z" }, "terminationReason": "Error" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-cddphguiiu@sha256:5cd6198130eb4eca7bdb131b6fb6c3ac68634ca1c4f966b8b8d810ffdae43235\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-rqft/dummy-public-key-qqrbdhadkt" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/e80ff33f-b9ee-46b6-a0aa-ca8c4a5193bc", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-912378535ce77509-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:34:18Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "deprecated-base-image-check", "tekton.dev/task": "deprecated-image-check", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "tes8769c73de16daa6d7d6546adde3c8fe6-deprecated-base-image-check", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "79482", "uid": "e80ff33f-b9ee-46b6-a0aa-ca8c4a5193bc" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:31Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:31Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "tes8769c73de16daa6d7d6546ad533cbf417b4e04fa6a29ee7e7cdced98-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, "entryPoint": "deprecated-image-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\", \"digests\": [\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:34:31+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-912378535ce77509-01" }, "startTime": "2026-05-19T11:34:18Z", "steps": [ { "container": "step-check-images", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "provenance": {}, "terminated": { "containerID": "cri-o://62e0afb32d3ae3a2a74011892b61a06f53c628a1dd19b5e595ddae816af54f7e", "exitCode": 0, "finishedAt": "2026-05-19T11:34:31Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\\\", \\\"digests\\\": [\\\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:31+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:23Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.", "params": [ { "default": "/project/repository/", "description": "Path to directory containing Conftest policies.", "name": "POLICY_DIR", "type": "string" }, { "default": "required_checks", "description": "Namespace for Conftest policy.", "name": "POLICY_NAMESPACE", "type": "string" }, { "default": "", "description": "Digests of base build images.", "name": "BASE_IMAGES_DIGESTS", "type": "string" }, { "description": "Fully qualified image name.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "POLICY_DIR", "value": "/project/repository/" }, { "name": "POLICY_NAMESPACE", "value": "required_checks" }, { "name": "BASE_IMAGES_DIGESTS" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n while read -r arch arch_sha; do\n SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Get base images from SBOM\n if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n echo \"Unable to download sbom for arch $arch.\"\n continue\n fi\n\n \u003c \"${SBOM_FILE_PATH}\" jq -r '\n if .bomFormat == \"CycloneDX\" then\n .formulation[]?\n | .components[]?\n | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n | (\n .purl\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n else\n .packages[]\n | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n | (\n $purls | first\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n end\n ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"Detected base images from $arch SBOM:\"\n cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"\"\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n # Get images from the parameter\n for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n do\n echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n mkdir -p \"${IMAGE_REPO_PATH}\"\n echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n if [ \"$http_code\" == \"200\" ];\n then\n echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${failures_num}\" -gt 0 ]]; then\n echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n fi\n failure_counter=$((failure_counter+failures_num))\n\n successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${successes_num}\" -gt 0 ]]; then\n echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n fi\n success_counter=$((success_counter+successes_num))\n\n elif [ \"$http_code\" == \"404\" ];\n then\n echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n warnings_counter=$((warnings_counter+1))\n else\n echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n error_counter=$((error_counter+1))\n fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n if [[ \"${failure_counter}\" -gt 0 ]]; then\n RES=\"FAILURE\"\n elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n RES=\"WARNING\"\n elif [[ \"${success_counter}\" -eq 0 ]]; then\n # when all counters are 0, there are no base images to check\n note=\"Task deprecated-image-check success: No base images to check.\"\n RES=\"SUCCESS\"\n else\n RES=\"SUCCESS\"\n fi\n TEST_OUTPUT=$(make_result_json \\\n -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/150f9ef9-b254-4bed-8c2a-6df0d93a1904", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-c7e5e1711e243e08-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:34:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "rpms-signature-scan", "tekton.dev/task": "rpms-signature-scan", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-p8769c73de16daa6d7d6546adde3c8fe6-rpms-signature-scan", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "79768", "uid": "150f9ef9-b254-4bed-8c2a-6df0d93a1904" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "image-digest", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:44Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:44Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-p8769c73de16daa6d00f745a7b1ae8382ecff97a86aefd04c-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213" }, "entryPoint": "rpms-signature-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\", \"digests\": [\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\"]}}\n" }, { "name": "RPMS_DATA", "type": "string", "value": "{\"keys\": {\"199e2f91fd431d51\": 132, \"unsigned\": 0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:34:44+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-c7e5e1711e243e08-01" }, "startTime": "2026-05-19T11:34:20Z", "steps": [ { "container": "step-rpms-signature-scan", "imageID": "quay.io/konflux-ci/tools@sha256:0d2fbb45b33949aa7474157b7cae3a55d3a399405fd8bef75dd73d0bee96890a", "name": "rpms-signature-scan", "provenance": {}, "terminated": { "containerID": "cri-o://e25cbb777eead9ccf66d3183dd443204f127736e538d44c425eb63417a29b11a", "exitCode": 0, "finishedAt": "2026-05-19T11:34:43Z", "reason": "Completed", "startedAt": "2026-05-19T11:34:23Z" }, "terminationReason": "Completed" }, { "container": "step-output-results", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "provenance": {}, "terminated": { "containerID": "cri-o://dda17404c57c6a79f005feb5d2249ddb6fc3119f21418662db7e9625be9b1e7e", "exitCode": 0, "finishedAt": "2026-05-19T11:34:44Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\\\", \\\"digests\\\": [\\\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 132, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:44+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:43Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans RPMs in an image and provide information about RPMs signatures.", "params": [ { "description": "Image URL", "name": "image-url", "type": "string" }, { "description": "Image digest to scan", "name": "image-digest", "type": "string" }, { "default": "/tmp", "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n", "name": "workdir", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Information about signed and unsigned RPMs", "name": "RPMS_DATA", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "200m", "memory": "256Mi" }, "requests": { "cpu": "200m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/tools@sha256:cdab2b0f6e01ed7852ad4c5376fd58bdbfe0db1379dd5acf42aad722a0f1e168", "name": "rpms-signature-scan", "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n --image-url \"${IMAGE_URL}\" \\\n --image-digest \"${IMAGE_DIGEST}\" \\\n --workdir \"${WORKDIR}\" \\\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "50m", "memory": "32Mi" }, "requests": { "cpu": "50m", "memory": "32Mi" } }, "env": [ { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-eef9e241e5", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/baf08258-49f3-44b1-ad4f-a67847f03842", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-77edc511902f97b8-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:34:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "sast-unicode-check", "tekton.dev/task": "sast-unicode-check", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pa8769c73de16daa6d7d6546adde3c8fe6-sast-unicode-check", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "79465", "uid": "baf08258-49f3-44b1-ad4f-a67847f03842" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "TARGET_DIRS", "value": "." } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check:0.4@sha256:c162d9d0cd1e4c64dfc340577ba8e6bf55ebd1bb859fe3157217de9b4473c640" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "workspace", "persistentVolumeClaim": { "claimName": "pvc-37138652bb" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:31Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:31Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-pa8769c73de16daa6b372462906283bbebbba84f873efb5c3-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "c162d9d0cd1e4c64dfc340577ba8e6bf55ebd1bb859fe3157217de9b4473c640" }, "entryPoint": "sast-unicode-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:34:28+00:00\",\"note\":\"Task sast-unicode-check success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-77edc511902f97b8-01" }, "startTime": "2026-05-19T11:34:19Z", "steps": [ { "container": "step-sast-unicode-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-unicode-check", "provenance": {}, "terminated": { "containerID": "cri-o://9065ac17b867d71e38a20ab342fb8e0f9206365592b03164452890a03e503634", "exitCode": 0, "finishedAt": "2026-05-19T11:34:28Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:28+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:28Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://a95ebb0640e5d8249d40e638441f1ec9893473b5d59e7cb08aebb9eb204369b7", "exitCode": 0, "finishedAt": "2026-05-19T11:34:30Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:28+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:29Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans source code for non-printable unicode characters in all text files.", "params": [ { "description": "Image digest used for ORAS upload.", "name": "image-digest", "type": "string" }, { "description": "Image URL used for ORAS upload.", "name": "image-url", "type": "string" }, { "default": "-p bidi -v -d -t", "description": "arguments for find-unicode-control command.", "name": "FIND_UNICODE_CONTROL_ARGS", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "cpu": "100m", "memory": "4Gi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "FIND_UNICODE_CONTROL_ARGS", "value": "-p bidi -v -d -t" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_CODE_DIR", "value": "/workspace/workspace" }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-unicode-check", "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n \u003eraw_sast_unicode_check_out.txt \\\n 2\u003eraw_sast_unicode_check_out.log \\\n || FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n echo \"Failed to run find-unicode-control command\" \u003e\u00262\n cat raw_sast_unicode_check_out.log\n note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n --mode=json\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"${SCAN_PROP}\"\n --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003e processed_sast_unicode_check_out.json 2\u003e processed_sast_unicode_check_out.err; then\n echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n cat processed_sast_unicode_check_out.err\n note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # Build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n # Append --record-excluded option if RECORD_EXCLUDED is true\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003e sast_unicode_check_out.json 2\u003e sast_unicode_check_out.error\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n else\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003e sast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n note=\"Task sast-unicode-check success: No finding was detected\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n note=\"Task sast-unicode-check success: Some findings were detected, but filtered by known false positive\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n echo \"sast-unicode-check test failed because of the following issues:\"\n cat sast_unicode_check_out.json\n TEST_OUTPUT=\n parse_test_output \"sast-unicode-check\" sarif sast_unicode_check_out.sarif || true\n note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/workspace/workspace/hacbs/sast-unicode-check" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n echo 'No image-url param provided. Skipping upload.'\n exit 0;\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n MEDIA_TYPE=application/json\n else\n MEDIA_TYPE=application/sarif+json\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"${IMAGE_URL}\" \u003e \"${HOME}/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/workspace/workspace/hacbs/sast-unicode-check" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "name": "workspace" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-eef9e241e5", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/b5a60477-07bd-4cd8-85f1-f528c2233d83", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-79bd90b0021ae157-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:32:40Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pac-8769c73de16daa6d7d6546adde3c8fe6-clone-repository", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "76408", "uid": "b5a60477-07bd-4cd8-85f1-f528c2233d83" }, "spec": { "params": [ { "name": "url", "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration" }, { "name": "revision", "value": "15c736138db312262c419f53b45167c09b9722a6" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "git-clone" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1@sha256:7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "output", "persistentVolumeClaim": { "claimName": "pvc-37138652bb" } }, { "name": "basic-auth", "secret": { "secretName": "pac-gitauth-nfiwin" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:32:56Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:32:56Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-pac-8769c73de16da3b7cdd0c7ab2e65d2a08f6cd7ef30d5b-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21" }, "entryPoint": "git-clone", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "15c736138db312262c419f53b45167c09b9722a6" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration" }, { "name": "commit", "type": "string", "value": "15c736138db312262c419f53b45167c09b9722a6" }, { "name": "commit-timestamp", "type": "string", "value": "1779190345" }, { "name": "short-commit", "type": "string", "value": "15c7361" }, { "name": "url", "type": "string", "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-79bd90b0021ae157-01" }, "startTime": "2026-05-19T11:32:40Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "provenance": {}, "terminated": { "containerID": "cri-o://71ff2a570d89a9f134cb63fb9ca4a449b71ce36422182350fdbe21a14859d3ca", "exitCode": 0, "finishedAt": "2026-05-19T11:32:55Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"15c736138db312262c419f53b45167c09b9722a6\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/hacbs-test-project-integration\",\"type\":1},{\"key\":\"commit\",\"value\":\"15c736138db312262c419f53b45167c09b9722a6\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190345\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"15c7361\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/hacbs-test-project-integration\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:32:54Z" }, "terminationReason": "Completed" }, { "container": "step-symlink-check", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "provenance": {}, "terminated": { "containerID": "cri-o://1413991507b122a545facfc62164c197073ab882df72cc680e05179a6518cef6", "exitCode": 0, "finishedAt": "2026-05-19T11:32:55Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"15c736138db312262c419f53b45167c09b9722a6\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/hacbs-test-project-integration\",\"type\":1},{\"key\":\"commit\",\"value\":\"15c736138db312262c419f53b45167c09b9722a6\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1779190345\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"15c7361\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/hacbs-test-project-integration\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:32:55Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone Task will clone a repo from the provided url into the output Workspace. By default the repo will be cloned into the root of your Workspace.", "params": [ { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n", "name": "submodulePaths", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "7", "description": "Length of short commit SHA", "name": "shortCommitLength", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "source", "description": "Subdirectory inside the `output` Workspace to clone the repo into.", "name": "subdirectory", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Clean out the contents of the destination directory if it already exists before cloning.", "name": "deleteExisting", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "false", "description": "Log the commands that are executed during `git-clone`'s operation.", "name": "verbose", "type": "string" }, { "default": "", "description": "Deprecated. Has no effect. Will be removed in the future.", "name": "gitInitImage", "type": "string" }, { "default": "/tekton/home", "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n", "name": "userHome", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" } ], "steps": [ { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "PARAM_URL", "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration" }, { "name": "PARAM_REVISION", "value": "15c736138db312262c419f53b45167c09b9722a6" }, { "name": "PARAM_REFSPEC" }, { "name": "PARAM_SUBMODULES", "value": "true" }, { "name": "PARAM_SUBMODULE_PATHS" }, { "name": "PARAM_DEPTH", "value": "1" }, { "name": "PARAM_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "PARAM_SSL_VERIFY", "value": "true" }, { "name": "PARAM_SUBDIRECTORY", "value": "source" }, { "name": "PARAM_DELETE_EXISTING", "value": "true" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "PARAM_VERBOSE", "value": "false" }, { "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "PARAM_USER_HOME", "value": "/tekton/home" }, { "name": "PARAM_FETCH_TAGS", "value": "false" }, { "name": "PARAM_GIT_INIT_IMAGE" }, { "name": "PARAM_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "PARAM_TARGET_BRANCH", "value": "main" }, { "name": "PARAM_MERGE_SOURCE_REPO_URL" }, { "name": "PARAM_MERGE_SOURCE_DEPTH" }, { "name": "WORKSPACE_OUTPUT_PATH", "value": "/workspace/output" }, { "name": "WORKSPACE_SSH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_SSH_DIRECTORY_PATH" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND", "value": "true" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH", "value": "/workspace/basic-auth" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ] ; then\n set -x\nfi\n\nif [ -n \"${PARAM_GIT_INIT_IMAGE}\" ]; then\n echo \"WARNING: provided deprecated gitInitImage parameter has no effect.\"\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n # Compatibility with kubernetes.io/basic-auth secrets\n elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e \"${PARAM_USER_HOME}/.git-credentials\"\n echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n helper = store\" \u003e \"${PARAM_USER_HOME}/.gitconfig\"\n else\n echo \"Unknown basic-auth workspace format\"\n exit 1\n fi\n chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\n\ncleandir() {\n # Delete any existing contents of the repo directory if it exists.\n #\n # We don't just \"rm -rf ${CHECKOUT_DIR}\" because ${CHECKOUT_DIR} might be \"/\"\n # or the root of a mounted volume.\n if [ -d \"${CHECKOUT_DIR}\" ] ; then\n # Delete non-hidden files and directories\n rm -rf \"${CHECKOUT_DIR:?}\"/*\n # Delete files and directories starting with . but excluding ..\n rm -rf \"${CHECKOUT_DIR}\"/.[!.]*\n # Delete files and directories starting with .. plus any other character\n rm -rf \"${CHECKOUT_DIR}\"/..?*\n fi\n}\n\nif [ \"${PARAM_DELETE_EXISTING}\" = \"true\" ] ; then\n cleandir\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n -url=\"${PARAM_URL}\" \\\n -revision=\"${PARAM_REVISION}\" \\\n -refspec=\"${PARAM_REFSPEC}\" \\\n -path=\"${CHECKOUT_DIR}\" \\\n -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n -submodules=\"${PARAM_SUBMODULES}\" \\\n -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n -depth=\"${PARAM_DEPTH}\" \\\n -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n # Determine if merging from a different repository or the same one\n if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n normalize_url() {\n echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n }\n\n NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n MERGE_REMOTE=\"origin\"\n else\n echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n echo \"Adding remote 'merge-source'...\"\n git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n MERGE_REMOTE=\"merge-source\"\n fi\n else\n echo \"Merging from the same repository (origin)\"\n MERGE_REMOTE=\"origin\"\n fi\n\n echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n else\n retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n fi\n\n\n echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n git config --global user.email \"tekton-git-clone@tekton.dev\"\n git config --global user.name \"Tekton Git Clone Task\"\n\nif ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n echo \"--- Git Status ---\"\n git status\n echo \"------------------\"\n exit 1\nfi\n\n# Check if there are changes staged for commit\nif git diff --staged --quiet; then\n echo \"No diff was found, skipping merge...\" \u003e\u00262\nelse\n echo \"Merge successful (no conflicts found), committing...\"\nif ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n exit 1\nfi\n MERGED_SHA=$(git rev-parse HEAD)\n echo \"New HEAD after merge: ${MERGED_SHA}\"\n echo \"${MERGED_SHA}\" \u003e \"/tekton/results/merged_sha\"\nfi\n\nelse\n echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e \"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e \"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ] ; then\n echo \"Fetching tags\"\n retry git fetch --tags\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, { "computeResources": {}, "env": [ { "name": "PARAM_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "PARAM_SUBDIRECTORY", "value": "source" }, { "name": "WORKSPACE_OUTPUT_PATH", "value": "/workspace/output" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\ncheck_symlinks() {\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n while read -r symlink\n do\n target=$(readlink -m \"$symlink\")\n if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n fi\n done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ] ; then\n return 1\n fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ] ; then\n echo \"Running symlink check\"\n check_symlinks\nfi\n" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The git repo will be cloned onto the volume backing this Workspace.", "name": "output" }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true }, { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-eef9e241e5", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/faa5094f-7158-4fb2-bd1a-aed025a496d3", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-6c42429e813f27e3-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:34:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "sast-shell-check", "tekton.dev/task": "sast-shell-check", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pac-8769c73de16daa6d7d6546adde3c8fe6-sast-shell-check", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "79495", "uid": "faa5094f-7158-4fb2-bd1a-aed025a496d3" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "TARGET_DIRS", "value": "." } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "sast-shell-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check:0.1@sha256:2cd09c97b9f0fae9c7bcd26d956f77221fb7137ee8b2ef17e7351b5e6f1eb89e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "workspace", "persistentVolumeClaim": { "claimName": "pvc-37138652bb" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:32Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:32Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-pac-8769c73de16da4ef6542c33854f7076aa15425505da23-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "2cd09c97b9f0fae9c7bcd26d956f77221fb7137ee8b2ef17e7351b5e6f1eb89e" }, "entryPoint": "sast-shell-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-19T11:34:30+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-6c42429e813f27e3-01" }, "startTime": "2026-05-19T11:34:19Z", "steps": [ { "container": "step-sast-shell-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:169f73f80fbde8d54f42416c5de8cc9214ecc7e8c89c70a3385285bbac32ad0a", "name": "sast-shell-check", "provenance": {}, "terminated": { "containerID": "cri-o://871abeb7d6f6e99ce7adcc370de286592a253a2c81570c333f697f905e07f1c8", "exitCode": 0, "finishedAt": "2026-05-19T11:34:30Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:30+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:29Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:5da32f9d64fdb2a960792e282f739e9d398a69e4c43d7183323ea8a13b845c73", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://b09635cfd2f717085b669e5aa4d704c2cd5b1cf4426801ba810008740c966b7c", "exitCode": 0, "finishedAt": "2026-05-19T11:34:31Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:30+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:31Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.", "params": [ { "default": "", "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image digest to report findings for.", "name": "image-digest", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "default": "true", "description": "Whether to include important findings only", "name": "IMP_FINDINGS_ONLY", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "8", "memory": "4Gi" }, "requests": { "cpu": "1", "memory": "4Gi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "IMP_FINDINGS_ONLY", "value": "true" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.51@sha256:169f73f80fbde8d54f42416c5de8cc9214ecc7e8c89c70a3385285bbac32ad0a", "name": "sast-shell-check", "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/workspace/workspace/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c \"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n resolved_path=$(realpath -m \"$potential_path\")\n\n # ensure resolved path is still within SOURCE_CODE_DIR\n if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n ALL_TARGETS+=(\"$resolved_path\")\n else\n echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n exit 1\n fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n read -r quota period \u003c /sys/fs/cgroup/cpu.max\n if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n export SC_JOBS=$(((quota + period - 1) / period))\n echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n --mode=json\n --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n # predefined list of shellcheck important findings\n CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n CSGREP_OPTS+=(\n --event=\"$CSGREP_EVENT_FILTER\"\n )\nelse\n CSGREP_OPTS+=(\n --event=\"error|warning\"\n )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e \"$OUTPUT_FILE\"; then\n echo \"Error occurred while running 'run-shellcheck.sh'\"\n note=\"Task sast-shell-check failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e \"${OUTPUT_FILE}.filtered\" 2\u003e \"${OUTPUT_FILE}.error\"\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n else\n mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003e shellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/workspace/workspace/hacbs/sast-shell-check" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:6a46c5960cbcb81d9f6b0206163102d6f2e9e649ec231136f9ee33c02d3c1ad0", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n echo 'No image-url or image-digest param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n # Determine the media type based on the file extension\n if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n MEDIA_TYPE=\"application/json\"\n else\n MEDIA_TYPE=\"application/sarif+json\"\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\n then\n echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n exit 1\n fi\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/workspace/workspace/hacbs/sast-shell-check" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "name": "workspace" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-eef9e241e5", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/45d2e3d9-c332-44b1-b2a8-7121b4deb032", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-f551164880bde3e1-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:33:06Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah-min", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pac-g8769c73de16daa6d7d6546adde3c8fe6-build-container", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "77966", "uid": "45d2e3d9-c332-44b1-b2a8-7121b4deb032" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" }, { "name": "COMMIT_SHA", "value": "15c736138db312262c419f53b45167c09b9722a6" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "buildah-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-min:0.9" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "source", "persistentVolumeClaim": { "claimName": "pvc-37138652bb" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:07Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:07Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-pac-g8769c73de16de1277ea2221c71e14d155b9435e866ab-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "83455b969b5b0f5e8cd96708b393343123754ec01d3d3cdaf531208693978a50" }, "entryPoint": "buildah-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-min" } }, "results": [ { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "SBOM_BLOB_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:4790527247340ec7beb14c14062013bec61b99f628989d7bb425742e218ee0a5" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-f551164880bde3e1-01" }, "startTime": "2026-05-19T11:33:07Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://da4243ec5d5392edde78dd78ea6018c32ef08bf7457a4dbc9fc460c8368e0abb", "exitCode": 0, "finishedAt": "2026-05-19T11:33:43Z", "reason": "Completed", "startedAt": "2026-05-19T11:33:13Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://5376732c5e806e7d4388e44633ff89de9a6bfbb35f32874240de1e1e05b48c20", "exitCode": 0, "finishedAt": "2026-05-19T11:33:49Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:33:43Z" }, "terminationReason": "Completed" }, { "container": "step-sbom-syft-generate", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "provenance": {}, "terminated": { "containerID": "cri-o://cab220d1be5fa59b4475e398ee824bbbca310d80bdc582a82c351739ee924738", "exitCode": 0, "finishedAt": "2026-05-19T11:33:57Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:33:49Z" }, "terminationReason": "Completed" }, { "container": "step-prepare-sboms", "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "provenance": {}, "terminated": { "containerID": "cri-o://d8a38652970d2f05b840cb5d224335c231467847353f7e9255c8b551f0ea75d7", "exitCode": 0, "finishedAt": "2026-05-19T11:34:02Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:33:57Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://3d80b213925a1e734c01b47b3f1d6c236fdefbbea00f0f3179ec706a8befdae8", "exitCode": 0, "finishedAt": "2026-05-19T11:34:07Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:4790527247340ec7beb14c14062013bec61b99f628989d7bb425742e218ee0a5\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:03Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "env": [ { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "HERMETIC", "value": "false" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "CONTEXT", "value": "." }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "6h" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" }, { "name": "TARGET_STAGE" }, { "name": "ENTITLEMENT_SECRET", "value": "etc-pki-entitlement" }, { "name": "ACTIVATION_KEY", "value": "activation-key" }, { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "BUILD_ARGS_FILE" }, { "name": "ADD_CAPABILITIES" }, { "name": "SQUASH", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "ANNOTATIONS_FILE" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SKIP_INJECTIONS", "value": "false" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" } ] }, "steps": [ { "args": [ "--build-args", "--env", "--labels", "--annotations" ], "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "cpu": "100m", "memory": "1Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "15c736138db312262c419f53b45167c09b9722a6" }, { "name": "SOURCE_URL", "value": "https://gitlab.com/konflux-qe/hacbs-test-project-integration" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n fi\n fi\n}\n\nfunction unset_proxy {\n echo \"[$(date --utc -Ins)] Unsetting proxy\"\n unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n \"$source_dir_path\" | \"$source_dir_path/\"*)\n # path is valid, do nothing\n ;;\n *)\n echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n echo \"Source path: $source_dir_path\" \u003e\u00262\n echo \"Resolved path: $context_dir_path\" \u003e\u00262\n exit 1\n ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n # Instrumented builds (SAST) use this custom dockerfile step as their base\n dockerfile_path=\"$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e /etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n while IFS= read -r line || [[ -n \"$line\" ]]; do\n # Skip empty lines and comments\n if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n ANNOTATIONS+=(\"--annotation\" \"$line\")\n fi\n done \u003c \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --build-args)\n shift\n # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do build_args+=(\"$1\"); shift; done\n ;;\n --env)\n shift\n # Collect env entries of the form KEY=value\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do env_vars+=(\"$1\"); shift; done\n ;;\n --labels)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do LABELS+=(\"--label\" \"$1\"); shift; done\n ;;\n --annotations)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ANNOTATIONS+=(\"--annotation\" \"$1\"); shift; done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e /shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--pull=never\")\n UNSHARE_ARGS+=(\"--net\")\n buildah_retries=3\n\n set_proxy\n\n for image in $BASE_IMAGES; do\n if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"\n then\n echo \"Failed to pull base image ${image}\"\n exit 1\n fi\n done\n\n unset_proxy\n\n echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n BUILDAH_ARGS+=(\"--cap-add=all\")\n BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ] ; then\n BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ] ; then\n BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n fi\n if [ -n \"$BUILD_TIMESTAMP\" ]; then\n echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n exit 1\n fi\n # but do set it so that we get all the labels/annotations associated with it\n BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/workspace/source/cachi2/cachi2.env\" ]; then\n # Identify the current arch to filter the prefetched content\n PREFETCH_ARCH=\"$(uname -m)\"\n echo \"$PREFETCH_ARCH\" \u003e /shared/prefetch-arch\n\n echo \"Prefetched content will be made available\"\n\n cp -r \"/workspace/source/cachi2\" /tmp/\n chmod -R go+rwX /tmp/cachi2\n\n # In case RPMs were prefetched and this is a multi-arch build,\n # clean up the packages that do not match the architecture being built\n RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n echo \"Removing prefetched RPMs from non-matching architectures\"\n PREFETCH_ARCH=\"$(uname -m)\"\n for path in \"$RPM_PREFETCH_DIR\"/*; do\n if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n echo \"Removing: $path\"\n rm -rf \"$path\"\n else\n echo \"Keeping: $path\"\n fi\n done\n fi\n\n VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n sed -E -i \\\n -e 'H;1h;$!d;x' \\\n -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n @igM' \\\n \"$dockerfile_copy\"\n\n prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n mkdir -p \"$YUM_REPOS_D_FETCHED\"\n if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n fi\n fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n \"--label\" \"architecture=$(uname -m)\"\n \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n FINAL_BASE_IMAGE=$(\n # Get the base image of the final stage\n # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n # Run the find_root_stage() function on the final stage\n # If the final stage is scratch or oci-archive, return empty\n jq -r '.Stages as $all_stages |\n def find_root_stage($stage):\n if $stage.From.Stage then\n find_root_stage($all_stages[$stage.From.Stage.Index])\n else\n $stage\n end;\n\n find_root_stage(.Stages[-1]) |\n if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n empty\n else\n .BaseName\n end' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n )\n if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n set_proxy\n buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null` `\n unset_proxy\n buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n if [[ \"$label\" != \"--label\" ]]; then\n label_pairs+=(\"$label\")\n fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n echo \"\" \u003e\u003e\"$dockerfile_copy\"\n # Always write labels.json to the new standard location\n echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n # Conditionally write to the old location for backward compatibility\n if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n cp \"$containerignore\" \"$ignorefile_copy\"\n {\n echo \"\"\n echo \"!/labels.json\"\n echo \"!/content-sets.json\"\n } \u003e\u003e \"$ignorefile_copy\"\n BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n mkdir -p /shared/rhsm/etc/pki/entitlement\n mkdir -p /shared/rhsm/etc/pki/consumer\n\n VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key \\\n -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z \\\n -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n echo \"Adding activation key to the build\"\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n echo \"Pre-registering with subscription manager.\"\n export RETRY_MAX_TRIES=6\n if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"\n then\n echo \"Subscription-manager register failed\"\n exit 1\n fi\n unset RETRY_MAX_TRIES\n trap 'subscription-manager unregister || true' EXIT\n\n # copy generated certificates to /shared volume\n cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e /dev/null; then\n cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n exit 1\n fi\n # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n # (we set the workdir using 'unshare -w')\n context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n # Instrumented builds (SAST) use this step as their base and add some other tools.\n while read -r volume_mount; do\n VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n done \u003c\u003c\u003c \"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n while read -r filename; do\n echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n buildah build\n \"${VOLUME_MOUNTS[@]}\"\n \"${BUILDAH_ARGS[@]}\"\n \"${LABELS[@]}\"\n \"${ANNOTATIONS[@]}\"\n --tls-verify=\"$TLSVERIFY\" --no-cache\n --ulimit nofile=4096:4096\n --http-proxy=false\n -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n # Get the image pullspec and filter out a tag if it is not set\n # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n # if buildah did not use that particular image during build because it was skipped\n if [ -n \"$base_image_digest\" ]; then\n echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e /shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/workspace/source" }, { "computeResources": {}, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "test-comp-pac-g8769c73de16daa6d7d6546adde3c8fe6-build-container" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"\nthen\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/workspace/source/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"\nthen\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c \"/workspace/source\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n echo -n \"${IMAGE}@\"\n cat \"/workspace/source/image-digest\"\n} \u003e \"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"\nthen\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e /shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e /tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"\n then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/workspace/source" }, { "computeResources": {}, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\n cyclonedx)\n syft_sbom_type=cyclonedx-json@1.5 ;;\n spdx)\n syft_sbom_type=spdx-json@2.3 ;;\n *)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/workspace/source/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/workspace/source/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/workspace/source/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/workspace/source/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "10m", "memory": "128Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ADDITIONAL_BASE_IMAGES+=(\"$1\"); shift; done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/workspace/source/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/workspace/source/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/workspace/source/sbom-source.json\")\nfi\n\nif [ -f \"/workspace/source/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/workspace/source/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/workspace/source" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"\n then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/workspace/source" } ], "volumes": [ { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "shared" }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } } ], "workspaces": [ { "description": "Workspace containing the source code to build.", "name": "source" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-eef9e241e5", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/5d8f775c-e521-4049-ac85-bc8c3ee34a21", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, appstudio", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-68c7893166be6104-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:34:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "push-dockerfile", "tekton.dev/task": "push-dockerfile", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pac-g8769c73de16daa6d7d6546adde3c8fe6-push-dockerfile", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "79416", "uid": "5d8f775c-e521-4049-ac85-bc8c3ee34a21" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "CONTEXT", "value": "." } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "push-dockerfile" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile:0.3@sha256:359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "workspace", "persistentVolumeClaim": { "claimName": "pvc-37138652bb" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:29Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:29Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-pac-g8769c73de16d37bdc12bf8f70914f8d914eecf185c8a-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7" }, "entryPoint": "push-dockerfile", "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile" } }, "results": [ { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:8132efcf8c9f04e8c14500b28770ad1ad28b21b956d99577ae2f40eb3ef236d0" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-68c7893166be6104-01" }, "startTime": "2026-05-19T11:34:19Z", "steps": [ { "container": "step-push", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://bfe9abb394064189366ddb4e5e7710282bf40cc07524369db4b3b85bcbd1a8ce", "exitCode": 0, "finishedAt": "2026-05-19T11:34:28Z", "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:8132efcf8c9f04e8c14500b28770ad1ad28b21b956d99577ae2f40eb3ef236d0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:28Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.", "params": [ { "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.", "name": "IMAGE", "type": "string" }, { "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile.", "name": "DOCKERFILE", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": ".dockerfile", "description": "Suffix of the Dockerfile image tag.", "name": "TAG_SUFFIX", "type": "string" }, { "default": "application/vnd.konflux.dockerfile", "description": "Artifact type of the Dockerfile image.", "name": "ARTIFACT_TYPE", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "info", "description": "Log level to use in the task. See golang logrus docs for available levels.", "name": "LOG_LEVEL", "type": "string" } ], "results": [ { "description": "Digest-pinned image reference to the Dockerfile image.", "name": "IMAGE_REF", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "args": [ "--source", "source", "--context", ".", "--containerfile", "Dockerfile", "--image-url", "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6", "--image-digest", "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b", "--artifact-type", "application/vnd.konflux.dockerfile", "--tag-suffix", ".dockerfile", "--result-path-image-ref", "/tekton/results/IMAGE_REF", "--alternative-filename", "Dockerfile" ], "command": [ "konflux-build-cli", "image", "push-containerfile" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "push", "workingDir": "/workspace/workspace" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "Workspace containing the source code from where the Dockerfile is discovered.", "name": "workspace" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-eef9e241e5", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/edf9feb2-b5f7-4bff-9ccc-35106280dfa8", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-a46a932e6bdb59c8-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:34:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "sast-snyk-check", "tekton.dev/task": "sast-snyk-check", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pac-g8769c73de16daa6d7d6546adde3c8fe6-sast-snyk-check", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "79469", "uid": "edf9feb2-b5f7-4bff-9ccc-35106280dfa8" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "TARGET_DIRS", "value": "." } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "sast-snyk-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check:0.4@sha256:566753ca880764361b11f2c67d8e62dda94f829b11cb48e4716f27568216a481" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "workspace", "persistentVolumeClaim": { "claimName": "pvc-37138652bb" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:31Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:31Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-pac-g8769c73de16db467ff39631733b969d097326af3f51e-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "566753ca880764361b11f2c67d8e62dda94f829b11cb48e4716f27568216a481" }, "entryPoint": "sast-snyk-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-19T11:34:29+00:00\",\"note\":\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-a46a932e6bdb59c8-01" }, "startTime": "2026-05-19T11:34:19Z", "steps": [ { "container": "step-sast-snyk-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49", "name": "sast-snyk-check", "provenance": {}, "terminated": { "containerID": "cri-o://6820fb50e361d683665e0c2720c071b40e5f527ccd53e9714efb4a7cd42adf40", "exitCode": 0, "finishedAt": "2026-05-19T11:34:29Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:29+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:29Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://c6cd9088837959b6e4e7af894ee2f40224a2f5200399998c9a9b3c1b924d530f", "exitCode": 0, "finishedAt": "2026-05-19T11:34:30Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-19T11:34:29+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:30Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.", "params": [ { "default": "snyk-secret", "description": "Name of secret which contains Snyk token.", "name": "SNYK_SECRET", "type": "string" }, { "default": "", "description": "Append arguments.", "name": "ARGS", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "description": "Digest of the image to scan.", "name": "image-digest", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "true", "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.", "name": "IMP_FINDINGS_ONLY", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Write excluded records in file. Useful for auditing (defaults to false).", "name": "RECORD_EXCLUDED", "type": "string" }, { "default": "", "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.", "name": "IGNORE_FILE_PATHS", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "memory": "6Gi" }, "requests": { "cpu": "1", "memory": "6Gi" } }, "env": [ { "name": "SNYK_SECRET", "value": "snyk-secret" }, { "name": "ARGS" }, { "name": "IGNORE_FILE_PATHS" }, { "name": "IMP_FINDINGS_ONLY", "value": "true" }, { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } }, { "name": "TARGET_DIRS", "value": "." } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-snyk-check", "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n # SNYK token is provided\n SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n export SNYK_TOKEN\nelse\n # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n # shellcheck disable=SC2034\n to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n note=\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n snyk code test \"$@\" 1\u003e\u00262\u003e\u003e stdout.txt\n local ec=$?\n if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n SNYK_EXIT_CODE=$ec\n fi\n if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n return 0\n fi\n return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/workspace/workspace\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c \"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n resolved_path=$(realpath -m \"$potential_path\")\n\n # Ensure resolved path is still within SOURCE_CODE_DIR\n if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n exit 1\n fi\n\n # Ensure directory exists\n if [ ! -d \"$resolved_path\" ]; then\n echo \"Warning: Directory $resolved_path does not exist, skipping\"\n continue\n fi\n\n echo \"INFO: Scanning directory: $resolved_path\"\n # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n # shellcheck disable=SC2086\n RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n echo \"WARN: No JSON output files were generated by snyk scan\"\n # Get snyk version for proper SARIF metadata\n SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n # Create a valid minimal SARIF structure using jq\n # Note: coverage array is required even when empty because downstream jq commands expect it\n jq -n --arg version \"$SNYK_VERSION\" '{\n \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n \"version\": \"2.1.0\",\n \"runs\": [{\n \"tool\": {\n \"driver\": {\n \"name\": \"snyk\",\n \"version\": $version,\n \"informationUri\": \"https://snyk.io\"\n }\n },\n \"results\": [],\n \"properties\": {\n \"coverage\": []\n }\n }]\n }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n fi\n\n # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) \\\n | csgrep --mode=json --strip-path-prefix=\"source/\" \\\n \u003e sast_snyk_check_out_all_findings.json\n\n echo \"INFO: Initial results:\"\n csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n fi\n PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n # create the KFP clone directory regardless\n KFP_DIR=\"known-false-positives\"\n KFP_CLONED=\"0\"\n mkdir \"${KFP_DIR}\"\n\n # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n if [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\n fi\n\n if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n else\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n CMD=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n CMD+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n set +e\n \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003e filtered_sast_snyk_check_out.json\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n else\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\n echo \"INFO: Results after filtering:\"\n (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n fi\n\n # Generation of scan stats\n\n total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n # We make sure the values are 0 if no supported/total files are found\n if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n total_files=0\n fi\n\n if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n supported_files=0\n fi\n\n coverage_ratio=0\n if (( total_files \u003e 0 )); then\n coverage_ratio=$((supported_files * 100 / total_files))\n fi\n\n # embed stats in results file and convert to SARIF\n csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n filtered_sast_snyk_check_out.json \u003e sast_snyk_check_out.sarif\n\n # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n # - \"error\" → importance level 1\n # - \"warning\" (or missing level) → importance level 0\n RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e \"$RESULT_SARIF\"\n else\n # Use all findings for Tekton task result\n RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n fi\n\n TEST_OUTPUT=\n parse_test_output \"sast-snyk-check\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n note=\"Task sast-snyk-check success: Snyk code test found zero supported files.\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n echo \"sast-snyk-check test failed because of the following issues:\"\n cat stdout.txt\n note=\"Task sast-snyk-check failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/etc/secrets", "name": "snyk-secret", "readOnly": true }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/workspace/workspace/hacbs/sast-snyk-check" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n echo 'No image-url provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n MEDIA_TYPE=application/json\n else\n MEDIA_TYPE=application/sarif+json\n fi\n echo \"Selecting auth\"\n select-oci-auth \"${IMAGE_URL}\" \u003e \"${HOME}/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\n then\n echo \"Failed to attach to ${IMAGE_URL}\"\n fi\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/workspace/workspace/hacbs/sast-snyk-check" } ], "volumes": [ { "name": "snyk-secret", "secret": { "optional": true, "secretName": "snyk-secret" } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "name": "workspace" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/a72f6246-7172-4f84-b860-047dc7eefe70", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-5348d11d21659d02-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:34:18Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks", "tekton.dev/task": "ecosystem-cert-preflight-checks", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pac-gitlab-yjnmwd-on-d64d800592a1f4926d4b70953b1b79c2", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "80432", "uid": "a72f6246-7172-4f84-b860-047dc7eefe70" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "ecosystem-cert-preflight-checks" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:9c300728a03f41beee9a689422d66513d32ab5f804664fe561b11cebacd07799" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:35:24Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:35:24Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-pac-gitlab-yjnmwd41d678be74b2a005c9b7763180ee45ad-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "9c300728a03f41beee9a689422d66513d32ab5f804664fe561b11cebacd07799" }, "entryPoint": "ecosystem-cert-preflight-checks", "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks" } }, "results": [ { "name": "ARTIFACT_TYPE", "type": "string", "value": "application" }, { "name": "ARTIFACT_TYPE_SET_BY", "type": "string", "value": "introspection" }, { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\", \"digests\": [\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\"]}}" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1779190522\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-5348d11d21659d02-01" }, "startTime": "2026-05-19T11:34:19Z", "steps": [ { "container": "step-introspect", "imageID": "quay.io/konflux-ci/task-runner@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc", "name": "introspect", "provenance": {}, "results": [ { "name": "artifact-type", "type": "string", "value": "application" }, { "name": "artifact-type-set-by", "type": "string", "value": "introspection" } ], "terminated": { "containerID": "cri-o://a24fb914e07b2f1a160db1e0a7c404655d0b0538646b3f8c9fa908efb1bf6a5f", "exitCode": 0, "finishedAt": "2026-05-19T11:35:03Z", "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-19T11:35:02Z" }, "terminationReason": "Completed" }, { "container": "step-generate-container-auth", "imageID": "quay.io/konflux-ci/task-runner@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc", "name": "generate-container-auth", "provenance": {}, "results": [ { "name": "auth-json-path", "type": "string", "value": "/auth/auth.json" } ], "terminated": { "containerID": "cri-o://2eaa4b837f88bb4d90758b3c60003075cfa03259c7d16bd284d0c2b2d608bcaa", "exitCode": 0, "finishedAt": "2026-05-19T11:35:03Z", "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-19T11:35:03Z" }, "terminationReason": "Completed" }, { "container": "step-set-skip-for-bundles", "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064", "name": "set-skip-for-bundles", "provenance": {}, "terminated": { "containerID": "cri-o://40cc5c1af45cec9bcdd424c49ace35324d5c5ad7c18b37f9f39eb37434af0492", "exitCode": 0, "finishedAt": "2026-05-19T11:35:03Z", "reason": "Completed", "startedAt": "2026-05-19T11:35:03Z" }, "terminationReason": "Skipped" }, { "container": "step-app-check", "imageID": "quay.io/opdev/preflight@sha256:6dc9402d20c330e693e6a949ab42c8721e385f012379ff99d51310ec1cbef576", "name": "app-check", "provenance": {}, "terminated": { "containerID": "cri-o://a011907a0feb043978c9bd87f30e08cdf5d7b4ed5ad2bb73e4458a7f6cb43320", "exitCode": 0, "finishedAt": "2026-05-19T11:35:21Z", "reason": "Completed", "startedAt": "2026-05-19T11:35:04Z" }, "terminationReason": "Completed" }, { "container": "step-app-set-outcome", "imageID": "quay.io/konflux-ci/task-runner@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc", "name": "app-set-outcome", "provenance": {}, "results": [ { "name": "images-processed", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\", \"digests\": [\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\"]}}" }, { "name": "test-output", "type": "string", "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1779190522\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}" } ], "terminated": { "containerID": "cri-o://b1962575f05a5e57c889eab1ced083d1d0251937f3cf6378e79a275653d629bd", "exitCode": 0, "finishedAt": "2026-05-19T11:35:22Z", "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\\\", \\\"digests\\\": [\\\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"1779190522\\\",\\\"note\\\":\\\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\\\",\\\"successes\\\":7,\\\"failures\\\":1,\\\"warnings\\\":0}\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-19T11:35:22Z" }, "terminationReason": "Completed" }, { "container": "step-final-outcome", "imageID": "quay.io/konflux-ci/task-runner@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc", "name": "final-outcome", "provenance": {}, "results": [ { "name": "test-output", "type": "string", "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1779190522\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}" } ], "terminated": { "containerID": "cri-o://3223a05847defb63fa253034c4f3c3767d38a666154b624c050a587335d1bf4b", "exitCode": 0, "finishedAt": "2026-05-19T11:35:23Z", "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"1779190522\\\",\\\"note\\\":\\\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\\\",\\\"successes\\\":7,\\\"failures\\\":1,\\\"warnings\\\":0}\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-19T11:35:23Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.", "params": [ { "description": "Image url to scan.", "name": "image-url", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "introspect", "description": "The type of artifact. Select from application, operatorbundle, or introspect.", "name": "artifact-type", "type": "string" }, { "default": "", "description": "The platform the image is built on.", "name": "platform", "type": "string" } ], "results": [ { "description": "Ecosystem checks pass or fail outcome.", "name": "TEST_OUTPUT", "type": "string", "value": "$(steps.final-outcome.results.test-output)" }, { "description": "The artifact type, either introspected or set.", "name": "ARTIFACT_TYPE", "type": "string", "value": "$(steps.introspect.results.artifact-type)" }, { "description": "How the artifact type was set.", "name": "ARTIFACT_TYPE_SET_BY", "type": "string", "value": "$(steps.introspect.results.artifact-type-set-by)" }, { "description": "Collected image digests", "name": "IMAGES_PROCESSED", "type": "string", "value": "$(steps.app-set-outcome.results.images-processed)" } ], "steps": [ { "computeResources": { "limits": { "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "env": [ { "name": "PARAM_ARTIFACT_TYPE", "value": "introspect" }, { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" } ], "image": "quay.io/konflux-ci/task-runner:1.7.0@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc", "name": "introspect", "results": [ { "description": "The type of artifact this task is considering.", "name": "artifact-type" }, { "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n", "name": "artifact-type-set-by" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n echo \"Artifact type will be determined by introspection.\"\n _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n # short circuit if the artifact type was set via parameter.\n echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n _CURRENT_ARCH=$(uname -m)\n _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n # to map them.\n case ${_CURRENT_ARCH} in\n \"aarch64\")\n _CURRENT_ARCH=\"arm64\"\n ;;\n \"x86_64\")\n _CURRENT_ARCH=\"amd64\"\n ;;\n *)\n ;;\n esac\n\n # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n else\n # If there is no image for the current OS and architecture, just use the first one in the list.\n _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n | jq '.Labels | keys | .[]' -r \\\n | { grep operators.operatorframework.io.bundle || true ;} \\\n | tee /tmp/ecosystem-image-labels\nthen\n echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n" }, { "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "50m", "memory": "64Mi" } }, "env": [ { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" } ], "image": "quay.io/konflux-ci/task-runner:1.7.0@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc", "name": "generate-container-auth", "results": [ { "description": "Path to auth.json", "name": "auth-json-path" } ], "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n", "volumeMounts": [ { "mountPath": "/auth", "name": "auth" } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1", "name": "set-skip-for-bundles", "results": [ { "description": "A skipped tekton result for bundles.", "name": "test-output" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n", "volumeMounts": [ { "mountPath": "/bundle", "name": "pfltoutputdir" } ], "when": [ { "input": "$(steps.introspect.results.artifact-type)", "operator": "in", "values": [ "operatorbundle" ] } ] }, { "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "cpu": "1", "memory": "4Gi" } }, "env": [ { "name": "PFLT_DOCKERCONFIG", "value": "$(steps.generate-container-auth.results.auth-json-path)" }, { "name": "PFLT_KONFLUX", "value": "true" }, { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "PARAM_PLATFORM" } ], "image": "quay.io/opdev/preflight:stable@sha256:6dc9402d20c330e693e6a949ab42c8721e385f012379ff99d51310ec1cbef576", "name": "app-check", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n # Extract part after slash if present\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n\n # Validate against supported arch list. If it's not a known arch, return an error result\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 0\n ;;\n esac\n\n /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n /usr/local/bin/preflight check container \"$image_url\"\nfi\n", "volumeMounts": [ { "mountPath": "/artifacts", "name": "pfltoutputdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" }, { "mountPath": "/auth", "name": "auth", "readOnly": true } ], "when": [ { "input": "$(steps.introspect.results.artifact-type)", "operator": "in", "values": [ "application" ] } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" } ], "image": "quay.io/konflux-ci/task-runner:1.7.0@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc", "name": "app-set-outcome", "results": [ { "description": "The overall outcome of this task.", "name": "test-output" }, { "description": "Processed image digests.", "name": "images-processed" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n # Check if results directory exits\n RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n continue\n fi\n # Process results\n if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{ result: $result,\n timestamp: $date,\n note: $note,\n successes: $successes|tonumber,\n failures: $failures|tonumber,\n warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n", "volumeMounts": [ { "mountPath": "/artifacts", "name": "pfltoutputdir" } ], "when": [ { "input": "$(steps.introspect.results.artifact-type)", "operator": "in", "values": [ "application" ] } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.7.0@sha256:1c0582a85dae0949f3ec94aca95695c5d7698b371f1b76c5a78822a6249073dc", "name": "final-outcome", "results": [ { "name": "test-output" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n", "volumeMounts": [ { "mountPath": "/mount", "name": "pfltoutputdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "pfltoutputdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "auth" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/24279f05-ecda-4b03-be5f-c5e9a035c98b", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-ef278e0eed908d5a-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:34:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "apply-tags", "tekton.dev/task": "apply-tags", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw-apply-tags", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "79243", "uid": "24279f05-ecda-4b03-be5f-c5e9a035c98b" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "apply-tags" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:24Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:24Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-pac-gitlab-yjnmwd741a31d8c7896a40cfed18c4a82adeb8-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66" }, "entryPoint": "apply-tags", "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags" } }, "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-ef278e0eed908d5a-01" }, "startTime": "2026-05-19T11:34:20Z", "steps": [ { "container": "step-apply-additional-tags", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "apply-additional-tags", "provenance": {}, "terminated": { "containerID": "cri-o://70b2b70b277c13ccd2f6d906d2354fb53680fc9a46a50760b1ba1aedb781a274", "exitCode": 0, "finishedAt": "2026-05-19T11:34:24Z", "reason": "Completed", "startedAt": "2026-05-19T11:34:23Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Applies additional tags to the built image.", "params": [ { "description": "Image repository and tag reference of the the built image.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest of the built image.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": [], "description": "Additional tags that will be applied to the image in the registry.", "name": "ADDITIONAL_TAGS", "type": "array" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "info", "description": "Log level to use in the task. See golang logrus docs for available levels.", "name": "LOG_LEVEL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "args": [ "--image-url", "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6", "--digest", "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b", "--tags", "--tags-from-image-label", "konflux.additional-tags" ], "command": [ "konflux-build-cli", "image", "apply-tags" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "apply-additional-tags" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/248b81f0-6659-4e59-82a5-0902dc0515c2", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-d7fa970521b184f8-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:34:18Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "clair-scan", "tekton.dev/task": "clair-scan", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw-clair-scan", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "79945", "uid": "248b81f0-6659-4e59-82a5-0902dc0515c2" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "clair-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:8fad4c2e2f470f82ee43d6b2ac72327b4d9c6e9cb514a678911c1c9359c29894" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "completionTime": "2026-05-19T11:34:54Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:54Z", "message": "the step \"get-vulnerabilities\" in TaskRun \"test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw-clair-scan\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/clair-in-ci:v1\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "test-comp-pac-gitlab-yjnmwd835e951df5b0ef2a2ef3a81f7a7a8b87-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "8fad4c2e2f470f82ee43d6b2ac72327b4d9c6e9cb514a678911c1c9359c29894" }, "entryPoint": "clair-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan" } }, "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-d7fa970521b184f8-01" }, "startTime": "2026-05-19T11:34:18Z", "steps": [ { "container": "step-get-image-manifests", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "get-image-manifests", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T11:34:54Z", "message": "Step get-image-manifests terminated as pod test-comp-pac-gitlab-yjnmwd835e951df5b0ef2a2ef3a81f7a7a8b87-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T11:34:21Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-get-vulnerabilities", "name": "get-vulnerabilities", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T11:34:54Z", "message": "Step get-vulnerabilities terminated as pod test-comp-pac-gitlab-yjnmwd835e951df5b0ef2a2ef3a81f7a7a8b87-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T11:34:18Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-oci-attach-report", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T11:34:54Z", "message": "Step oci-attach-report terminated as pod test-comp-pac-gitlab-yjnmwd835e951df5b0ef2a2ef3a81f7a7a8b87-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T11:34:52Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-conftest-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "conftest-vulnerabilities", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T11:34:54Z", "message": "Step conftest-vulnerabilities terminated as pod test-comp-pac-gitlab-yjnmwd835e951df5b0ef2a2ef3a81f7a7a8b87-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T11:34:53Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "The platform built by.", "name": "image-platform", "type": "string" }, { "default": "", "description": "unused, should be removed in next task version.", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-oci-attach-report", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Clair scan result.", "name": "SCAN_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" }, { "description": "Mapping of image digests to report digests", "name": "REPORTS", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "RETRY_COUNT", "value": "5" } ], "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "get-image-manifests", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$IMAGE_URL\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n echo \"$arch_sha\" \u003e \"/tekton/home/image-manifest-${arch}.sha\"\n done\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } }, { "computeResources": { "limits": { "cpu": "800m", "memory": "7Gi" }, "requests": { "cpu": "800m", "memory": "7Gi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "IMAGE_PLATFORM" } ], "image": "quay.io/konflux-ci/clair-in-ci:v1", "imagePullPolicy": "Always", "name": "get-vulnerabilities", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\n\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$IMAGE_URL\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --docker-config-dir=/tmp/auth --format=clair | tee \"clair-report-$2.json\"; } \u0026\u0026 \\\n { retry clair-action convert --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n local arch=\"$1\"\n local sha_file=\"image-manifest-$arch.sha\"\n\n if [ -e \"$sha_file\" ]; then\n local arch_sha\n arch_sha=$(\u003c\"$sha_file\")\n local digest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running clair-action on $arch image manifest...\"\n clair_report \"$digest\" \"$arch\" || true\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n # Validate against supported arch list. If it's not a known arch, fallback to amd64\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 0\n ;;\n esac\n\n run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n for sha_file in image-manifest-*.sha; do\n if [ -e \"$sha_file\" ]; then\n arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n run_clair_on_arch \"$arch\"\n fi\n done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho \"$images_processed\" \u003e images-processed.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_OCI_ATTACH_REPORT", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n echo 'OCI attach report skipped by parameter.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n echo 'No Clair reports generated. Skipping upload.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n report_file=\"$1\"\n arch=\"${report_file/*-}\"\n echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n image_ref=\"${repository}@${digest}\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e /tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n echo \"Attaching $f to ${image_ref}\"\n if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n then\n echo \"Failed to attach ${f} to ${image_ref}\"\n exit 1\n fi\n # shellcheck disable=SC2016\n reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "conftest-vulnerabilities", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n if [ ! -s \"$file\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n else\n /usr/bin/conftest test --no-fail \"$file\" \\\n --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n --output=json | tee \"/tekton/home/clair-vulnerabilities-${file_suffix}.json\" || true\n fi\n\n #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n result=$(jq -rce \\\n '{\n vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n },\n unpatched_vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n }\n }' \"$file\")\n\n scan_result=$(jq -s -rce \\\n '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ntee \"/tekton/results/IMAGES_PROCESSED\" \u003c /tekton/home/images-processed.json\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/34dd5acb-b022-4a96-a6c6-c87f15764d9b", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "virus, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-c96d9a7e6febaa3d-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:34:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "clamav-scan", "tekton.dev/task": "clamav-scan", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw-clamav-scan", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "80594", "uid": "34dd5acb-b022-4a96-a6c6-c87f15764d9b" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "clamav-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:567cb66bd2e1f4b58b9d4d756f3317fc62479e0b40aa0de66094b1f12d296cfc" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:35:28Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:35:28Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-pac-gitlab-yjnmwdd8fa9ec6bbe981520ce98e73cb4c46ae-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "567cb66bd2e1f4b58b9d4d756f3317fc62479e0b40aa0de66094b1f12d296cfc" }, "entryPoint": "clamav-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\", \"digests\": [\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1779190525\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-c96d9a7e6febaa3d-01" }, "startTime": "2026-05-19T11:34:20Z", "steps": [ { "container": "step-extract-and-scan-image", "imageID": "quay.io/konflux-ci/clamav-db@sha256:2ee72ac5cda517125824c8139ade1dbf21ee93377e78ece9ef24ec0c55518fe9", "name": "extract-and-scan-image", "provenance": {}, "terminated": { "containerID": "cri-o://0071b1d768ec1720f8bae77cfcf6da44da7ce8bf0af238f75419d3da85a722db", "exitCode": 0, "finishedAt": "2026-05-19T11:35:25Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\\\", \\\"digests\\\": [\\\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190525\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:24Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "provenance": {}, "terminated": { "containerID": "cri-o://3127efcf5b0291bcf6f8bdabd8a9b74244b73483d31f2e777cc5f235756bfc66", "exitCode": 0, "finishedAt": "2026-05-19T11:35:27Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\\\", \\\"digests\\\": [\\\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1779190525\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:35:25Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image arch.", "name": "image-arch", "type": "string" }, { "default": "", "description": "unused", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "8", "description": "Maximum number of threads clamd runs.", "name": "clamd-max-threads", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-upload", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "7300m", "memory": "12Gi" }, "requests": { "cpu": "7300m", "memory": "12Gi" } }, "env": [ { "name": "HOME", "value": "/work" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "IMAGE_ARCH" }, { "name": "MAX_THREADS", "value": "8" } ], "image": "quay.io/konflux-ci/clamav-db:latest", "name": "extract-and-scan-image", "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n mkdir -p ~/.docker\n echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n# $1: destination - path to the content to scan\n# $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n# $3: digest - digest to add to digests_processed array\n# $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n local destination=\"$1\"\n local suffix=\"$2\"\n local digest=\"$3\"\n local scan_message=\"${4:-Scanning content}\"\n\n db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n echo \"$scan_message. This operation may take a while.\"\n clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n digests_processed+=(\"\\\"$digest\\\"\")\n\n if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n # OPA/EC requires structured data input, add clamAV log into json\n jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o json \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o appstudio \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n\n if [ -n \"$raw_manifest\" ]; then\n media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n # Determine if this is an OCI artifact (not a container image)\n # OCI artifacts typically have:\n # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n # - An explicit artifactType field that is not a container image type\n is_oci_artifact=false\n\n # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n is_oci_artifact=true\n fi\n\n # Check if artifactType is set and is not a container image type\n if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n is_oci_artifact=true\n fi\n\n if [ \"$is_oci_artifact\" = true ]; then\n # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n # This looks like a container image manifest, but get_image_manifests failed\n echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n else\n # Likely an OCI artifact with non-standard media type\n echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n fi\n else\n echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n echo \"Detected container image. Processing image manifests.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n # Proceed only if a specific arch is provided.\n # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n if [ -n \"$IMAGE_ARCH\" ]; then\n arch=\"${IMAGE_ARCH#*/}\"\n if [ \"${arch}\" = \"x86_64\" ]; then\n arch=\"amd64\"\n fi\n\n # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n arch=\"amd64\"\n ;;\n esac\n\n image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n fi\n\n while read -r arch arch_sha; do\n destination=$(echo content-$arch)\n mkdir -p \"$destination\"\n arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n if [ $? -ne 0 ]; then\n echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n exit 0\n fi\n\n # Scan and process container image for this architecture\n scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n {\n \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n \"namespace\" : $item.namespace,\n \"successes\" : (.successes + $item.successes),\n \"failures\" : (.failures + $item.failures),\n \"warnings\" : (.warnings + $item.warnings),\n \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_UPLOAD", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "IMAGE_DIGEST", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n echo \"Upload skipped by parameter.\"\n exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n MEDIA_TYPE=text/vnd.clamav\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n MEDIA_TYPE=application/vnd.konflux.test_output+json\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n echo \"No files found. Skipping upload.\"\n exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n", "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" } ], "volumes": [ { "emptyDir": {}, "name": "dbfolder" }, { "emptyDir": {}, "name": "work" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/2073e9cb-b0b0-47c7-a51a-e44cf1615d31", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-2a22a5708ff0dd5c-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:32:35Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw-init", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "76092", "uid": "2073e9cb-b0b0-47c7-a51a-e44cf1615d31" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:32:40Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:32:40Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-2a22a5708ff0dd5c-01" }, "startTime": "2026-05-19T11:32:35Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "init", "provenance": {}, "terminated": { "containerID": "cri-o://3c03597e668463b681757d40d85839130165684a130670bd41b5a7f4662b8dcc", "exitCode": 0, "finishedAt": "2026-05-19T11:32:39Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:32:39Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/dad2fdf1-6ccb-490e-a7f1-8ea9c97c4b92", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-7685f23dbe9a0cb3-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:34:08Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "build-image-index", "tekton.dev/task": "build-image-index", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp-pac8769c73de16daa6d7d6546adde3c8fe6-build-image-index", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "79047", "uid": "dad2fdf1-6ccb-490e-a7f1-8ea9c97c4b92" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "build-image-index" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:34:18Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:34:18Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp-pac8769c73de16daaea1783c28b92b7274199595f59fb8549-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb" }, "entryPoint": "build-image-index", "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index" } }, "results": [ { "name": "IMAGES", "type": "string", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" } ], "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-7685f23dbe9a0cb3-01" }, "startTime": "2026-05-19T11:34:08Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://19687408fa2e74661d24cb0b23bdc27f670aab6235ed7560aa6a09b5131a47e0", "exitCode": 0, "finishedAt": "2026-05-19T11:34:15Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:12Z" }, "terminationReason": "Completed" }, { "container": "step-create-sbom", "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://9babe42f740b93f1a5080403e0ca01f2f7942f766929b5cdc42ea007071d80fa", "exitCode": 0, "finishedAt": "2026-05-19T11:34:15Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:15Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://6cdb7398a4aca01b00a572a5072fd7c2f808080a1ab05e300f674640e37b331e", "exitCode": 0, "finishedAt": "2026-05-19T11:34:18Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-19T11:34:16Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This takes existing Image Manifests and combines them in an Image Index.", "params": [ { "description": "The target image and tag where the image will be pushed to.", "name": "IMAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "description": "List of Image Manifests to be referenced by the Image Index", "name": "IMAGES", "type": "array" }, { "default": "true", "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.", "name": "ALWAYS_BUILD_INDEX", "type": "string" }, { "default": "vfs", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": "false", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "List of all referenced image manifests", "name": "IMAGES", "type": "string" }, { "description": "Image reference of the built image containing both the repository and the digest", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "vfs" } ], "volumeMounts": [ { "mountPath": "/index-build-data", "name": "shared-dir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "quay.io/redhat-appstudio-qe/gitlab-rep-pmrm/test-comp-pac-gitlab-yjnmwd:on-pr-15c736138db312262c419f53b45167c09b9722a6@sha256:8e3ed9359c6ed54016f4e3bcea279203b55a8ac10038f97e34f2adb5356c0f8b" ], "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "cpu": "250m", "memory": "4Gi" } }, "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n --image \"$IMAGE\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --buildah-format \"$BUILDAH_FORMAT\" \\\n --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n --additional-tags \"test-comp-pac8769c73de16daa6d7d6546adde3c8fe6-build-image-index\" \\\n --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n --result-path-images \"/tekton/results/IMAGES\" \\\n --images \"$@\"; then\n echo \"Failed to build image index\"\n exit 1\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-index\n --index-image-pullspec \"$IMAGE_URL\"\n --index-image-digest \"$IMAGE_DIGEST\"\n --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n" }, { "computeResources": { "limits": { "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 } } ], "volumes": [ { "emptyDir": {}, "name": "shared-dir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/tree/15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/commit_sha": "15c736138db312262c419f53b45167c09b9722a6", "build.appstudio.redhat.com/pull_request_number": "17659", "build.appstudio.redhat.com/target_branch": "base-gitlab-jorwle", "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "2", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-eef9e241e5", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "pipelinesascode.tekton.dev/branch": "base-gitlab-jorwle", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "Merge Request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-nfiwin", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2537084688", "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-bc636effbc.yyst.p3.openshiftapps.com/k8s/ns/gitlab-rep-pmrm/tekton.dev~v1~PipelineRun/test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-gitlab-jorwle\"", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration/-/commit/15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/source-branch": "konflux-test-comp-pac-gitlab-yjnmwd", "pipelinesascode.tekton.dev/source-project-id": "56586709", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/hacbs-test-project-integration", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/target-project-id": "56586709", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053/records/84c61804-9d9b-43bd-9734-cb6c2a1a5c23", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"hacbs-test-project-integration\",\"commit\":\"15c736138db312262c419f53b45167c09b9722a6\",\"eventType\":\"Merge Request\",\"pull_request-id\":17659}", "results.tekton.dev/result": "gitlab-rep-pmrm/results/ae091461-00e1-46dc-8807-9984a9663053", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-057eda90b7e57c0f98836c10cf98ef29-0d70a3dbebf90643-01\"}", "test.appstudio.openshift.io/pr-group": "konflux-test-comp-pac-gitlab-yjnmwd", "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed" }, "creationTimestamp": "2026-05-19T11:32:56Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.46.0", "appstudio.openshift.io/application": "integ-app-abdv", "appstudio.openshift.io/component": "test-comp-pac-gitlab-yjnmwd", "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/event-type": "Merge_Request", "pipelinesascode.tekton.dev/original-prname": "test-comp-pac-gitlab-yjnmwd-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "17659", "pipelinesascode.tekton.dev/repository": "gitlab-com-konflux-qe-hacbs-test-project-integration", "pipelinesascode.tekton.dev/sha": "15c736138db312262c419f53b45167c09b9722a6", "pipelinesascode.tekton.dev/state": "queued", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRun": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "tekton.dev/pipelineRunUID": "ae091461-00e1-46dc-8807-9984a9663053", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies", "test.appstudio.openshift.io/pr-group-sha": "ba25eddc1a5bce68f3d29d37e803cd48036198792f27e600e0fcbd3c4c1249" }, "name": "test-comp8769c73de16daa6d7d6546adde3c8fe6-prefetch-dependencies", "namespace": "gitlab-rep-pmrm", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "test-comp-pac-gitlab-yjnmwd-on-pull-request-vv5lw", "uid": "ae091461-00e1-46dc-8807-9984a9663053" } ], "resourceVersion": "76603", "uid": "84c61804-9d9b-43bd-9734-cb6c2a1a5c23" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "build-pipeline-test-comp-pac-gitlab-yjnmwd", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies:0.3@sha256:214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "source", "persistentVolumeClaim": { "claimName": "pvc-37138652bb" } }, { "name": "git-basic-auth", "secret": { "secretName": "pac-gitauth-nfiwin" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-05-19T11:33:06Z", "conditions": [ { "lastTransitionTime": "2026-05-19T11:33:06Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "test-comp8769c73de16daa6d7d3c9eb10d58d24dfde378f2bf9097142e-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f" }, "entryPoint": "prefetch-dependencies", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies" } }, "spanContext": { "traceparent": "00-057eda90b7e57c0f98836c10cf98ef29-0d70a3dbebf90643-01" }, "startTime": "2026-05-19T11:32:56Z", "steps": [ { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "provenance": {}, "terminated": { "containerID": "cri-o://abed82f0c67f9019365208a2d51e267502795ae55ef1ca2463ddb4389ee079a0", "exitCode": 0, "finishedAt": "2026-05-19T11:33:05Z", "reason": "Completed", "startedAt": "2026-05-19T11:33:02Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "1", "memory": "3Gi" }, "requests": { "cpu": "1", "memory": "3Gi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/workspace/source/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/workspace/source/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/workspace/source/cachi2/cachi2.env /workspace/source/cachi2/prefetch.env /workspace/source/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY", "value": "/workspace/git-basic-auth" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" } ], "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e /mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ] } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "emptyDir": {}, "name": "config" } ], "workspaces": [ { "description": "Workspace with the source code, prefetch artifacts will be stored on the workspace as well", "name": "source" }, { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "mintmaker/results/d19a1881-5683-4974-91d0-5812ac521579/records/a37c0c03-e2bf-4d78-9bab-2bd83098cfc6", "results.tekton.dev/result": "mintmaker/results/d19a1881-5683-4974-91d0-5812ac521579", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9f1f048a47ba44f5824cfb04fd7cdaaa-4b11cdd9722dbfd6-01\"}" }, "creationTimestamp": "2026-05-19T12:00:14Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "kueue.x-k8s.io/priority-class": "konflux-dependency-update", "kueue.x-k8s.io/queue-name": "pipelines-queue", "mintmaker.appstudio.redhat.com/application": "test-app-saax", "mintmaker.appstudio.redhat.com/branch": "base-wjjjny", "mintmaker.appstudio.redhat.com/component": "test-comp-ajcu", "mintmaker.appstudio.redhat.com/git-host": "github.com", "mintmaker.appstudio.redhat.com/git-platform": "github", "mintmaker.appstudio.redhat.com/namespace": "build-e2e-zdef", "mintmaker.appstudio.redhat.com/repo-branch-hash": "ebcdf4e8df14", "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_devfile-sample-python-basic", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-05191200-126404b0", "tekton.dev/pipelineRun": "renovate-05191200-126404b0", "tekton.dev/pipelineRunUID": "d19a1881-5683-4974-91d0-5812ac521579", "tekton.dev/pipelineTask": "build" }, "name": "renovate-05191200-126404b0-build", "namespace": "mintmaker", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-05191200-126404b0", "uid": "d19a1881-5683-4974-91d0-5812ac521579" } ], "resourceVersion": "113707", "uid": "a37c0c03-e2bf-4d78-9bab-2bd83098cfc6" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "mintmaker-controller-manager", "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-126404b0", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-126404b0-877cc23c", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-126404b0", "optional": false }, "name": "configmap-renovate-05191200-126404b0" }, { "name": "secret-renovate-05191200-126404b0-877cc23c", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-126404b0" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] }, "timeout": "2h0m0s", "workspaces": [ { "emptyDir": {}, "name": "shared-data" } ] }, "status": { "completionTime": "2026-05-19T12:02:29Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:02:29Z", "message": "the step \"renovate\" in TaskRun \"renovate-05191200-126404b0-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-05191200-126404b0-build-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-9f1f048a47ba44f5824cfb04fd7cdaaa-4b11cdd9722dbfd6-01" }, "startTime": "2026-05-19T12:00:14Z", "steps": [ { "container": "step-prepare-db", "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:a7f57ddb86bb202bfaf2edf83e47013d3a99bbb8f7e46e6ca3e7a02c8bb73421", "name": "prepare-db", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step prepare-db terminated as pod renovate-05191200-126404b0-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:18Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-prepare-rpm-cert", "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7", "name": "prepare-rpm-cert", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step prepare-rpm-cert terminated as pod renovate-05191200-126404b0-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:19Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step renovate terminated as pod renovate-05191200-126404b0-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:14Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-126404b0", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-126404b0-877cc23c", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-126404b0", "optional": false }, "name": "configmap-renovate-05191200-126404b0" }, { "name": "secret-renovate-05191200-126404b0-877cc23c", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-126404b0" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "mintmaker/results/68edc027-f46a-462c-8d31-ccd4d9241ee1/records/0757fe74-2e80-4755-a964-3edecdaef98d", "results.tekton.dev/result": "mintmaker/results/68edc027-f46a-462c-8d31-ccd4d9241ee1", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-eb584b18d3a29c1f76ebda6ef26c0ade-1727c7cebc093a08-01\"}" }, "creationTimestamp": "2026-05-19T12:00:14Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "kueue.x-k8s.io/priority-class": "konflux-dependency-update", "kueue.x-k8s.io/queue-name": "pipelines-queue", "mintmaker.appstudio.redhat.com/application": "build-suite-component-update-whwy", "mintmaker.appstudio.redhat.com/branch": "multi-component-parent-base-ozak", "mintmaker.appstudio.redhat.com/component": "gl-multi-component-parent-ozak", "mintmaker.appstudio.redhat.com/git-host": "gitlab.com", "mintmaker.appstudio.redhat.com/git-platform": "gitlab", "mintmaker.appstudio.redhat.com/namespace": "build-e2e-xudt", "mintmaker.appstudio.redhat.com/repo-branch-hash": "6058dc856a41", "mintmaker.appstudio.redhat.com/repository": "konflux-qe_build-nudge-parent-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-05191200-28ddc27f", "tekton.dev/pipelineRun": "renovate-05191200-28ddc27f", "tekton.dev/pipelineRunUID": "68edc027-f46a-462c-8d31-ccd4d9241ee1", "tekton.dev/pipelineTask": "build" }, "name": "renovate-05191200-28ddc27f-build", "namespace": "mintmaker", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-05191200-28ddc27f", "uid": "68edc027-f46a-462c-8d31-ccd4d9241ee1" } ], "resourceVersion": "113651", "uid": "0757fe74-2e80-4755-a964-3edecdaef98d" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "mintmaker-controller-manager", "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-28ddc27f", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-28ddc27f-62e6e1b3", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-28ddc27f", "optional": false }, "name": "configmap-renovate-05191200-28ddc27f" }, { "name": "secret-renovate-05191200-28ddc27f-62e6e1b3", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-28ddc27f" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] }, "timeout": "2h0m0s", "workspaces": [ { "emptyDir": {}, "name": "shared-data" } ] }, "status": { "completionTime": "2026-05-19T12:02:28Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:02:28Z", "message": "the step \"renovate\" in TaskRun \"renovate-05191200-28ddc27f-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-05191200-28ddc27f-build-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-eb584b18d3a29c1f76ebda6ef26c0ade-1727c7cebc093a08-01" }, "startTime": "2026-05-19T12:00:14Z", "steps": [ { "container": "step-prepare-db", "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:a7f57ddb86bb202bfaf2edf83e47013d3a99bbb8f7e46e6ca3e7a02c8bb73421", "name": "prepare-db", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:28Z", "message": "Step prepare-db terminated as pod renovate-05191200-28ddc27f-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:18Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-prepare-rpm-cert", "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7", "name": "prepare-rpm-cert", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:28Z", "message": "Step prepare-rpm-cert terminated as pod renovate-05191200-28ddc27f-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:19Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:28Z", "message": "Step renovate terminated as pod renovate-05191200-28ddc27f-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:14Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-28ddc27f", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-28ddc27f-62e6e1b3", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-28ddc27f", "optional": false }, "name": "configmap-renovate-05191200-28ddc27f" }, { "name": "secret-renovate-05191200-28ddc27f-62e6e1b3", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-28ddc27f" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "mintmaker/results/f5be1d3f-cae4-48b7-87a1-58fe2021eca8/records/86f59a68-2585-4133-868a-5c5767c40af7", "results.tekton.dev/result": "mintmaker/results/f5be1d3f-cae4-48b7-87a1-58fe2021eca8", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7deca2ab3034782a44a336e0d92b453f-d4c137108e6cc7e0-01\"}" }, "creationTimestamp": "2026-05-19T12:00:13Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "kueue.x-k8s.io/priority-class": "konflux-dependency-update", "kueue.x-k8s.io/queue-name": "pipelines-queue", "mintmaker.appstudio.redhat.com/application": "build-suite-component-update-cfgf", "mintmaker.appstudio.redhat.com/branch": "multi-component-parent-base-cevf", "mintmaker.appstudio.redhat.com/component": "gh-multi-component-parent-cevf", "mintmaker.appstudio.redhat.com/git-host": "github.com", "mintmaker.appstudio.redhat.com/git-platform": "github", "mintmaker.appstudio.redhat.com/namespace": "build-e2e-uvqz", "mintmaker.appstudio.redhat.com/repo-branch-hash": "484ef7e938e5", "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_build-nudge-parent-xoxpwm", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-05191200-35e2fec0", "tekton.dev/pipelineRun": "renovate-05191200-35e2fec0", "tekton.dev/pipelineRunUID": "f5be1d3f-cae4-48b7-87a1-58fe2021eca8", "tekton.dev/pipelineTask": "build" }, "name": "renovate-05191200-35e2fec0-build", "namespace": "mintmaker", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-05191200-35e2fec0", "uid": "f5be1d3f-cae4-48b7-87a1-58fe2021eca8" } ], "resourceVersion": "113785", "uid": "86f59a68-2585-4133-868a-5c5767c40af7" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "mintmaker-controller-manager", "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-35e2fec0", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-35e2fec0-b84bb52c", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-35e2fec0", "optional": false }, "name": "configmap-renovate-05191200-35e2fec0" }, { "name": "secret-renovate-05191200-35e2fec0-b84bb52c", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-35e2fec0" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] }, "timeout": "2h0m0s", "workspaces": [ { "emptyDir": {}, "name": "shared-data" } ] }, "status": { "completionTime": "2026-05-19T12:02:29Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:02:29Z", "message": "the step \"renovate\" in TaskRun \"renovate-05191200-35e2fec0-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-05191200-35e2fec0-build-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-7deca2ab3034782a44a336e0d92b453f-d4c137108e6cc7e0-01" }, "startTime": "2026-05-19T12:00:14Z", "steps": [ { "container": "step-prepare-db", "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:a7f57ddb86bb202bfaf2edf83e47013d3a99bbb8f7e46e6ca3e7a02c8bb73421", "name": "prepare-db", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step prepare-db terminated as pod renovate-05191200-35e2fec0-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:20Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-prepare-rpm-cert", "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7", "name": "prepare-rpm-cert", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step prepare-rpm-cert terminated as pod renovate-05191200-35e2fec0-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:21Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step renovate terminated as pod renovate-05191200-35e2fec0-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:13Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-35e2fec0", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-35e2fec0-b84bb52c", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-35e2fec0", "optional": false }, "name": "configmap-renovate-05191200-35e2fec0" }, { "name": "secret-renovate-05191200-35e2fec0-b84bb52c", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-35e2fec0" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "mintmaker/results/cfcfd6b5-695b-42cf-97d4-90515011ffa2/records/63a06132-ce07-48f1-a8c2-4861159d408d", "results.tekton.dev/result": "mintmaker/results/cfcfd6b5-695b-42cf-97d4-90515011ffa2", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4729881d6a58f9316a2a413e435cb885-a457dbfaaa00116e-01\"}" }, "creationTimestamp": "2026-05-19T12:00:14Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "kueue.x-k8s.io/priority-class": "konflux-dependency-update", "kueue.x-k8s.io/queue-name": "pipelines-queue", "mintmaker.appstudio.redhat.com/application": "build-suite-component-update-whwy", "mintmaker.appstudio.redhat.com/branch": "multi-component-child-base-ozak", "mintmaker.appstudio.redhat.com/component": "gl-multi-component-child-ozak", "mintmaker.appstudio.redhat.com/git-host": "gitlab.com", "mintmaker.appstudio.redhat.com/git-platform": "gitlab", "mintmaker.appstudio.redhat.com/namespace": "build-e2e-xudt", "mintmaker.appstudio.redhat.com/repo-branch-hash": "9cec72880328", "mintmaker.appstudio.redhat.com/repository": "konflux-qe_build-nudge-child-pqmvxn", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-05191200-4b002886", "tekton.dev/pipelineRun": "renovate-05191200-4b002886", "tekton.dev/pipelineRunUID": "cfcfd6b5-695b-42cf-97d4-90515011ffa2", "tekton.dev/pipelineTask": "build" }, "name": "renovate-05191200-4b002886-build", "namespace": "mintmaker", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-05191200-4b002886", "uid": "cfcfd6b5-695b-42cf-97d4-90515011ffa2" } ], "resourceVersion": "113467", "uid": "63a06132-ce07-48f1-a8c2-4861159d408d" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "mintmaker-controller-manager", "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-4b002886", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-4b002886-10b2c73a", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-4b002886", "optional": false }, "name": "configmap-renovate-05191200-4b002886" }, { "name": "secret-renovate-05191200-4b002886-10b2c73a", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-4b002886" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] }, "timeout": "2h0m0s", "workspaces": [ { "emptyDir": {}, "name": "shared-data" } ] }, "status": { "completionTime": "2026-05-19T12:02:26Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:02:26Z", "message": "the step \"renovate\" in TaskRun \"renovate-05191200-4b002886-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-05191200-4b002886-build-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-4729881d6a58f9316a2a413e435cb885-a457dbfaaa00116e-01" }, "startTime": "2026-05-19T12:00:14Z", "steps": [ { "container": "step-prepare-db", "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:a7f57ddb86bb202bfaf2edf83e47013d3a99bbb8f7e46e6ca3e7a02c8bb73421", "name": "prepare-db", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:26Z", "message": "Step prepare-db terminated as pod renovate-05191200-4b002886-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:18Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-prepare-rpm-cert", "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7", "name": "prepare-rpm-cert", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:26Z", "message": "Step prepare-rpm-cert terminated as pod renovate-05191200-4b002886-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:19Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:26Z", "message": "Step renovate terminated as pod renovate-05191200-4b002886-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:14Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-4b002886", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-4b002886-10b2c73a", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-4b002886", "optional": false }, "name": "configmap-renovate-05191200-4b002886" }, { "name": "secret-renovate-05191200-4b002886-10b2c73a", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-4b002886" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "mintmaker/results/28e40672-7fd0-40a4-b10f-ee6b899da7c4/records/dcbcd1d7-699f-46b0-9095-1f8f67d35a3b", "results.tekton.dev/result": "mintmaker/results/28e40672-7fd0-40a4-b10f-ee6b899da7c4", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-6e45f137e6ba7c7887ffe9207a3b1ae7-6d89ffc0e244fa89-01\"}" }, "creationTimestamp": "2026-05-19T12:00:13Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "kueue.x-k8s.io/priority-class": "konflux-dependency-update", "kueue.x-k8s.io/queue-name": "pipelines-queue", "mintmaker.appstudio.redhat.com/application": "build-suite-component-update-cfgf", "mintmaker.appstudio.redhat.com/branch": "multi-component-child-base-cevf", "mintmaker.appstudio.redhat.com/component": "gh-multi-component-child-cevf", "mintmaker.appstudio.redhat.com/git-host": "github.com", "mintmaker.appstudio.redhat.com/git-platform": "github", "mintmaker.appstudio.redhat.com/namespace": "build-e2e-uvqz", "mintmaker.appstudio.redhat.com/repo-branch-hash": "c00452ff6bd5", "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_build-nudge-child-xoxpwm", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-05191200-79a49a8f", "tekton.dev/pipelineRun": "renovate-05191200-79a49a8f", "tekton.dev/pipelineRunUID": "28e40672-7fd0-40a4-b10f-ee6b899da7c4", "tekton.dev/pipelineTask": "build" }, "name": "renovate-05191200-79a49a8f-build", "namespace": "mintmaker", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-05191200-79a49a8f", "uid": "28e40672-7fd0-40a4-b10f-ee6b899da7c4" } ], "resourceVersion": "113794", "uid": "dcbcd1d7-699f-46b0-9095-1f8f67d35a3b" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "mintmaker-controller-manager", "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-79a49a8f", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-79a49a8f-3ebf19bf", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-79a49a8f", "optional": false }, "name": "configmap-renovate-05191200-79a49a8f" }, { "name": "secret-renovate-05191200-79a49a8f-3ebf19bf", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-79a49a8f" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] }, "timeout": "2h0m0s", "workspaces": [ { "emptyDir": {}, "name": "shared-data" } ] }, "status": { "completionTime": "2026-05-19T12:02:29Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:02:29Z", "message": "the step \"renovate\" in TaskRun \"renovate-05191200-79a49a8f-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-05191200-79a49a8f-build-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-6e45f137e6ba7c7887ffe9207a3b1ae7-6d89ffc0e244fa89-01" }, "startTime": "2026-05-19T12:00:13Z", "steps": [ { "container": "step-prepare-db", "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:a7f57ddb86bb202bfaf2edf83e47013d3a99bbb8f7e46e6ca3e7a02c8bb73421", "name": "prepare-db", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step prepare-db terminated as pod renovate-05191200-79a49a8f-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:18Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-prepare-rpm-cert", "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7", "name": "prepare-rpm-cert", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step prepare-rpm-cert terminated as pod renovate-05191200-79a49a8f-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:19Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step renovate terminated as pod renovate-05191200-79a49a8f-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:13Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-79a49a8f", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-79a49a8f-3ebf19bf", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-79a49a8f", "optional": false }, "name": "configmap-renovate-05191200-79a49a8f" }, { "name": "secret-renovate-05191200-79a49a8f-3ebf19bf", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-79a49a8f" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "mintmaker/results/a8d58596-ca31-440f-b7de-c3e9c94b36d7/records/11a25960-36f8-4c1b-a482-613458c309e6", "results.tekton.dev/result": "mintmaker/results/a8d58596-ca31-440f-b7de-c3e9c94b36d7", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-6fef848e31a24992172e96a900115f39-2479bbc23fa0c908-01\"}" }, "creationTimestamp": "2026-05-19T12:00:17Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "kueue.x-k8s.io/priority-class": "konflux-dependency-update", "kueue.x-k8s.io/queue-name": "pipelines-queue", "mintmaker.appstudio.redhat.com/application": "konflux-demo-app", "mintmaker.appstudio.redhat.com/branch": "base-hhkijb", "mintmaker.appstudio.redhat.com/component": "konflux-demo-component-cjhs", "mintmaker.appstudio.redhat.com/git-host": "github.com", "mintmaker.appstudio.redhat.com/git-platform": "github", "mintmaker.appstudio.redhat.com/namespace": "konflux-jxql", "mintmaker.appstudio.redhat.com/repo-branch-hash": "9cab49afec3b", "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_hacbs-test-project-konflux-demo", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-05191200-a11d0205", "tekton.dev/pipelineRun": "renovate-05191200-a11d0205", "tekton.dev/pipelineRunUID": "a8d58596-ca31-440f-b7de-c3e9c94b36d7", "tekton.dev/pipelineTask": "build" }, "name": "renovate-05191200-a11d0205-build", "namespace": "mintmaker", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-05191200-a11d0205", "uid": "a8d58596-ca31-440f-b7de-c3e9c94b36d7" } ], "resourceVersion": "113912", "uid": "11a25960-36f8-4c1b-a482-613458c309e6" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "mintmaker-controller-manager", "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-a11d0205", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-a11d0205-4db5511f", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-a11d0205", "optional": false }, "name": "configmap-renovate-05191200-a11d0205" }, { "name": "secret-renovate-05191200-a11d0205-4db5511f", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-a11d0205" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] }, "timeout": "2h0m0s", "workspaces": [ { "emptyDir": {}, "name": "shared-data" } ] }, "status": { "completionTime": "2026-05-19T12:02:32Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:02:32Z", "message": "the step \"renovate\" in TaskRun \"renovate-05191200-a11d0205-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-05191200-a11d0205-build-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-6fef848e31a24992172e96a900115f39-2479bbc23fa0c908-01" }, "startTime": "2026-05-19T12:00:17Z", "steps": [ { "container": "step-prepare-db", "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:a7f57ddb86bb202bfaf2edf83e47013d3a99bbb8f7e46e6ca3e7a02c8bb73421", "name": "prepare-db", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:32Z", "message": "Step prepare-db terminated as pod renovate-05191200-a11d0205-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:21Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-prepare-rpm-cert", "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7", "name": "prepare-rpm-cert", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:32Z", "message": "Step prepare-rpm-cert terminated as pod renovate-05191200-a11d0205-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:22Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:32Z", "message": "Step renovate terminated as pod renovate-05191200-a11d0205-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:17Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-a11d0205", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-a11d0205-4db5511f", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-a11d0205", "optional": false }, "name": "configmap-renovate-05191200-a11d0205" }, { "name": "secret-renovate-05191200-a11d0205-4db5511f", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-a11d0205" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "mintmaker/results/d08df22f-f47a-46f6-ba19-0077a37daf87/records/63f03d31-1a19-4dd3-b36b-bb3ee4fcd579", "results.tekton.dev/result": "mintmaker/results/d08df22f-f47a-46f6-ba19-0077a37daf87", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fee7513f77d8ff876a750295cafa2a70-0cc420532ea1cfe2-01\"}" }, "creationTimestamp": "2026-05-19T12:00:16Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "kueue.x-k8s.io/priority-class": "konflux-dependency-update", "kueue.x-k8s.io/queue-name": "pipelines-queue", "mintmaker.appstudio.redhat.com/application": "test-app-saax", "mintmaker.appstudio.redhat.com/branch": "base-rlbevj", "mintmaker.appstudio.redhat.com/component": "test-symlink-comp-nwpo", "mintmaker.appstudio.redhat.com/git-host": "github.com", "mintmaker.appstudio.redhat.com/git-platform": "github", "mintmaker.appstudio.redhat.com/namespace": "build-e2e-zdef", "mintmaker.appstudio.redhat.com/repo-branch-hash": "80203cbc2711", "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_devfile-sample-python-basic", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-05191200-b437a7cf", "tekton.dev/pipelineRun": "renovate-05191200-b437a7cf", "tekton.dev/pipelineRunUID": "d08df22f-f47a-46f6-ba19-0077a37daf87", "tekton.dev/pipelineTask": "build" }, "name": "renovate-05191200-b437a7cf-build", "namespace": "mintmaker", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-05191200-b437a7cf", "uid": "d08df22f-f47a-46f6-ba19-0077a37daf87" } ], "resourceVersion": "113560", "uid": "63f03d31-1a19-4dd3-b36b-bb3ee4fcd579" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "mintmaker-controller-manager", "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-b437a7cf", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-b437a7cf-52e28474", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-b437a7cf", "optional": false }, "name": "configmap-renovate-05191200-b437a7cf" }, { "name": "secret-renovate-05191200-b437a7cf-52e28474", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-b437a7cf" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] }, "timeout": "2h0m0s", "workspaces": [ { "emptyDir": {}, "name": "shared-data" } ] }, "status": { "completionTime": "2026-05-19T12:02:27Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:02:27Z", "message": "the step \"renovate\" in TaskRun \"renovate-05191200-b437a7cf-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-05191200-b437a7cf-build-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-fee7513f77d8ff876a750295cafa2a70-0cc420532ea1cfe2-01" }, "startTime": "2026-05-19T12:00:16Z", "steps": [ { "container": "step-prepare-db", "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:a7f57ddb86bb202bfaf2edf83e47013d3a99bbb8f7e46e6ca3e7a02c8bb73421", "name": "prepare-db", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:27Z", "message": "Step prepare-db terminated as pod renovate-05191200-b437a7cf-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:21Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-prepare-rpm-cert", "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7", "name": "prepare-rpm-cert", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:27Z", "message": "Step prepare-rpm-cert terminated as pod renovate-05191200-b437a7cf-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:21Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:27Z", "message": "Step renovate terminated as pod renovate-05191200-b437a7cf-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:16Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-b437a7cf", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-b437a7cf-52e28474", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-b437a7cf", "optional": false }, "name": "configmap-renovate-05191200-b437a7cf" }, { "name": "secret-renovate-05191200-b437a7cf-52e28474", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-b437a7cf" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "mintmaker/results/bc9aa33a-b976-48f0-bf1e-e9c38cca8dec/records/45f3701f-a3f3-4e72-b43e-83dcc5e03e8d", "results.tekton.dev/result": "mintmaker/results/bc9aa33a-b976-48f0-bf1e-e9c38cca8dec", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-cfacec46182120c3b4cf2178dafa8cd0-b2e5a328a95f762e-01\"}" }, "creationTimestamp": "2026-05-19T12:00:16Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "kueue.x-k8s.io/priority-class": "konflux-dependency-update", "kueue.x-k8s.io/queue-name": "pipelines-queue", "mintmaker.appstudio.redhat.com/application": "integ-app-abdv", "mintmaker.appstudio.redhat.com/branch": "base-gitlab-jorwle", "mintmaker.appstudio.redhat.com/component": "test-comp-pac-gitlab-yjnmwd", "mintmaker.appstudio.redhat.com/git-host": "gitlab.com", "mintmaker.appstudio.redhat.com/git-platform": "gitlab", "mintmaker.appstudio.redhat.com/namespace": "gitlab-rep-pmrm", "mintmaker.appstudio.redhat.com/repo-branch-hash": "e722c5049e22", "mintmaker.appstudio.redhat.com/repository": "konflux-qe_hacbs-test-project-integration", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-05191200-d0798ca5", "tekton.dev/pipelineRun": "renovate-05191200-d0798ca5", "tekton.dev/pipelineRunUID": "bc9aa33a-b976-48f0-bf1e-e9c38cca8dec", "tekton.dev/pipelineTask": "build" }, "name": "renovate-05191200-d0798ca5-build", "namespace": "mintmaker", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-05191200-d0798ca5", "uid": "bc9aa33a-b976-48f0-bf1e-e9c38cca8dec" } ], "resourceVersion": "113559", "uid": "45f3701f-a3f3-4e72-b43e-83dcc5e03e8d" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "mintmaker-controller-manager", "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-d0798ca5", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-d0798ca5-f8b3f0d9", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-d0798ca5", "optional": false }, "name": "configmap-renovate-05191200-d0798ca5" }, { "name": "secret-renovate-05191200-d0798ca5-f8b3f0d9", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-d0798ca5" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] }, "timeout": "2h0m0s", "workspaces": [ { "emptyDir": {}, "name": "shared-data" } ] }, "status": { "completionTime": "2026-05-19T12:02:27Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:02:27Z", "message": "the step \"renovate\" in TaskRun \"renovate-05191200-d0798ca5-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-05191200-d0798ca5-build-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-cfacec46182120c3b4cf2178dafa8cd0-b2e5a328a95f762e-01" }, "startTime": "2026-05-19T12:00:16Z", "steps": [ { "container": "step-prepare-db", "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:a7f57ddb86bb202bfaf2edf83e47013d3a99bbb8f7e46e6ca3e7a02c8bb73421", "name": "prepare-db", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:27Z", "message": "Step prepare-db terminated as pod renovate-05191200-d0798ca5-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:21Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-prepare-rpm-cert", "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7", "name": "prepare-rpm-cert", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:27Z", "message": "Step prepare-rpm-cert terminated as pod renovate-05191200-d0798ca5-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:21Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:27Z", "message": "Step renovate terminated as pod renovate-05191200-d0798ca5-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:16Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-d0798ca5", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-d0798ca5-f8b3f0d9", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-d0798ca5", "optional": false }, "name": "configmap-renovate-05191200-d0798ca5" }, { "name": "secret-renovate-05191200-d0798ca5-f8b3f0d9", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-d0798ca5" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "mintmaker/results/e65cf575-3a09-4c02-883c-6d6ed94f7371/records/568944be-83fa-4688-929a-a803f9aee3a8", "results.tekton.dev/result": "mintmaker/results/e65cf575-3a09-4c02-883c-6d6ed94f7371", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4f86fa99d713e1fbd1e51c59e03b7cb8-6ad95c023af43eef-01\"}" }, "creationTimestamp": "2026-05-19T12:00:13Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "kueue.x-k8s.io/priority-class": "konflux-dependency-update", "kueue.x-k8s.io/queue-name": "pipelines-queue", "mintmaker.appstudio.redhat.com/application": "build-suite-test-application-cmny", "mintmaker.appstudio.redhat.com/branch": "default", "mintmaker.appstudio.redhat.com/component": "gh-test-custom-default-vzwrlr", "mintmaker.appstudio.redhat.com/git-host": "github.com", "mintmaker.appstudio.redhat.com/git-platform": "github", "mintmaker.appstudio.redhat.com/namespace": "build-e2e-norp", "mintmaker.appstudio.redhat.com/repo-branch-hash": "59e9c2afe4fc", "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_devfile-sample-hello-world-jupgmp", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-05191200-e6990043", "tekton.dev/pipelineRun": "renovate-05191200-e6990043", "tekton.dev/pipelineRunUID": "e65cf575-3a09-4c02-883c-6d6ed94f7371", "tekton.dev/pipelineTask": "build" }, "name": "renovate-05191200-e6990043-build", "namespace": "mintmaker", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-05191200-e6990043", "uid": "e65cf575-3a09-4c02-883c-6d6ed94f7371" } ], "resourceVersion": "113806", "uid": "568944be-83fa-4688-929a-a803f9aee3a8" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "mintmaker-controller-manager", "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-e6990043", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-e6990043-a3b93dc8", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-e6990043", "optional": false }, "name": "configmap-renovate-05191200-e6990043" }, { "name": "secret-renovate-05191200-e6990043-a3b93dc8", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-e6990043" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] }, "timeout": "2h0m0s", "workspaces": [ { "emptyDir": {}, "name": "shared-data" } ] }, "status": { "completionTime": "2026-05-19T12:02:29Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:02:29Z", "message": "the step \"renovate\" in TaskRun \"renovate-05191200-e6990043-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-05191200-e6990043-build-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-4f86fa99d713e1fbd1e51c59e03b7cb8-6ad95c023af43eef-01" }, "startTime": "2026-05-19T12:00:13Z", "steps": [ { "container": "step-prepare-db", "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:a7f57ddb86bb202bfaf2edf83e47013d3a99bbb8f7e46e6ca3e7a02c8bb73421", "name": "prepare-db", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step prepare-db terminated as pod renovate-05191200-e6990043-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:18Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-prepare-rpm-cert", "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7", "name": "prepare-rpm-cert", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step prepare-rpm-cert terminated as pod renovate-05191200-e6990043-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:19Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step renovate terminated as pod renovate-05191200-e6990043-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:13Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-e6990043", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-e6990043-a3b93dc8", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-e6990043", "optional": false }, "name": "configmap-renovate-05191200-e6990043" }, { "name": "secret-renovate-05191200-e6990043-a3b93dc8", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-e6990043" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "mintmaker/results/ede35998-46e3-4f9f-9c25-a6f68c857f29/records/9a13050f-4de5-4ae4-8bdb-954d32807276", "results.tekton.dev/result": "mintmaker/results/ede35998-46e3-4f9f-9c25-a6f68c857f29", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a25758bb4f6319d7e25788d965f309c-3136e2ba84ffc27a-01\"}" }, "creationTimestamp": "2026-05-19T12:00:15Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "kueue.x-k8s.io/priority-class": "konflux-dependency-update", "kueue.x-k8s.io/queue-name": "pipelines-queue", "mintmaker.appstudio.redhat.com/application": "test-app-saax", "mintmaker.appstudio.redhat.com/branch": "base-qojsgw", "mintmaker.appstudio.redhat.com/component": "test-comp-rjvk", "mintmaker.appstudio.redhat.com/git-host": "github.com", "mintmaker.appstudio.redhat.com/git-platform": "github", "mintmaker.appstudio.redhat.com/namespace": "build-e2e-zdef", "mintmaker.appstudio.redhat.com/repo-branch-hash": "4bd63faa100d", "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_devfile-sample-python-basic", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-05191200-ec251265", "tekton.dev/pipelineRun": "renovate-05191200-ec251265", "tekton.dev/pipelineRunUID": "ede35998-46e3-4f9f-9c25-a6f68c857f29", "tekton.dev/pipelineTask": "build" }, "name": "renovate-05191200-ec251265-build", "namespace": "mintmaker", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-05191200-ec251265", "uid": "ede35998-46e3-4f9f-9c25-a6f68c857f29" } ], "resourceVersion": "113793", "uid": "9a13050f-4de5-4ae4-8bdb-954d32807276" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "mintmaker-controller-manager", "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-ec251265", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-ec251265-b8a51d9b", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-ec251265", "optional": false }, "name": "configmap-renovate-05191200-ec251265" }, { "name": "secret-renovate-05191200-ec251265-b8a51d9b", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-ec251265" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] }, "timeout": "2h0m0s", "workspaces": [ { "emptyDir": {}, "name": "shared-data" } ] }, "status": { "completionTime": "2026-05-19T12:02:29Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:02:29Z", "message": "the step \"renovate\" in TaskRun \"renovate-05191200-ec251265-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-05191200-ec251265-build-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-4a25758bb4f6319d7e25788d965f309c-3136e2ba84ffc27a-01" }, "startTime": "2026-05-19T12:00:15Z", "steps": [ { "container": "step-prepare-db", "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:a7f57ddb86bb202bfaf2edf83e47013d3a99bbb8f7e46e6ca3e7a02c8bb73421", "name": "prepare-db", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step prepare-db terminated as pod renovate-05191200-ec251265-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:19Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-prepare-rpm-cert", "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7", "name": "prepare-rpm-cert", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step prepare-rpm-cert terminated as pod renovate-05191200-ec251265-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:19Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:29Z", "message": "Step renovate terminated as pod renovate-05191200-ec251265-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:15Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-ec251265", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-ec251265-b8a51d9b", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-ec251265", "optional": false }, "name": "configmap-renovate-05191200-ec251265" }, { "name": "secret-renovate-05191200-ec251265-b8a51d9b", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-ec251265" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "kueue.konflux-ci.dev/requests-mintmaker": "1", "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "mintmaker/results/526e222c-0d98-4526-9d0a-e21de6509f84/records/aefb8cdf-caec-4fe2-8d0d-8a780177d95a", "results.tekton.dev/result": "mintmaker/results/526e222c-0d98-4526-9d0a-e21de6509f84", "results.tekton.dev/stored": "true", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-3c32baae912760e8606664391a350525-ea6a4f2839001c9b-01\"}" }, "creationTimestamp": "2026-05-19T12:00:15Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "kueue.x-k8s.io/priority-class": "konflux-dependency-update", "kueue.x-k8s.io/queue-name": "pipelines-queue", "mintmaker.appstudio.redhat.com/application": "test-app-saax", "mintmaker.appstudio.redhat.com/branch": "base-ftlleb", "mintmaker.appstudio.redhat.com/component": "test-comp-jlwr", "mintmaker.appstudio.redhat.com/git-host": "github.com", "mintmaker.appstudio.redhat.com/git-platform": "github", "mintmaker.appstudio.redhat.com/namespace": "build-e2e-zdef", "mintmaker.appstudio.redhat.com/repo-branch-hash": "0310d5925312", "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_devfile-sample-python-basic", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-05191200-fd042192", "tekton.dev/pipelineRun": "renovate-05191200-fd042192", "tekton.dev/pipelineRunUID": "526e222c-0d98-4526-9d0a-e21de6509f84", "tekton.dev/pipelineTask": "build" }, "name": "renovate-05191200-fd042192-build", "namespace": "mintmaker", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-05191200-fd042192", "uid": "526e222c-0d98-4526-9d0a-e21de6509f84" } ], "resourceVersion": "113916", "uid": "aefb8cdf-caec-4fe2-8d0d-8a780177d95a" }, "spec": { "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "mintmaker-controller-manager", "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-fd042192", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-fd042192-97b80186", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-fd042192", "optional": false }, "name": "configmap-renovate-05191200-fd042192" }, { "name": "secret-renovate-05191200-fd042192-97b80186", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-fd042192" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] }, "timeout": "2h0m0s", "workspaces": [ { "emptyDir": {}, "name": "shared-data" } ] }, "status": { "completionTime": "2026-05-19T12:02:32Z", "conditions": [ { "lastTransitionTime": "2026-05-19T12:02:32Z", "message": "the step \"renovate\" in TaskRun \"renovate-05191200-fd042192-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"", "reason": "TaskRunImagePullFailed", "status": "False", "type": "Succeeded" } ], "podName": "renovate-05191200-fd042192-build-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "spanContext": { "traceparent": "00-3c32baae912760e8606664391a350525-ea6a4f2839001c9b-01" }, "startTime": "2026-05-19T12:00:15Z", "steps": [ { "container": "step-prepare-db", "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:a7f57ddb86bb202bfaf2edf83e47013d3a99bbb8f7e46e6ca3e7a02c8bb73421", "name": "prepare-db", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:32Z", "message": "Step prepare-db terminated as pod renovate-05191200-fd042192-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:20Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-prepare-rpm-cert", "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7", "name": "prepare-rpm-cert", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:32Z", "message": "Step prepare-rpm-cert terminated as pod renovate-05191200-fd042192-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:21Z" }, "terminationReason": "TaskRunImagePullFailed" }, { "container": "step-renovate", "name": "renovate", "provenance": {}, "terminated": { "exitCode": 1, "finishedAt": "2026-05-19T12:02:32Z", "message": "Step renovate terminated as pod renovate-05191200-fd042192-build-pod is terminated", "reason": "TaskRunImagePullFailed", "startedAt": "2026-05-19T12:00:15Z" }, "terminationReason": "TaskRunImagePullFailed" } ], "taskSpec": { "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mintmaker-osv-database:latest", "name": "prepare-db", "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 } }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "registry.access.redhat.com/ubi9", "name": "prepare-rpm-cert", "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "cpu": "300m", "memory": "3584Mi" }, "requests": { "cpu": "300m", "memory": "3584Mi" } }, "env": [ { "name": "HOME", "value": "/home/renovate" }, { "name": "LOG_LEVEL", "value": "debug" }, { "name": "LOG_FORMAT", "value": "json" }, { "name": "OSV_OFFLINE_DISABLE_DOWNLOAD", "value": "true" }, { "name": "OSV_OFFLINE_ROOT_DIR", "value": "/workspace/shared-data/osv-db" }, { "name": "DNF_VAR_SSL_CLIENT_KEY", "value": "/workspace/shared-data/rpm-certs/key.pem" }, { "name": "DNF_VAR_SSL_CLIENT_CERT", "value": "/workspace/shared-data/rpm-certs/cert.pem" }, { "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS", "value": "7" } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest", "name": "renovate", "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "runAsUser": 1001120000 }, "volumeMounts": [ { "mountPath": "/etc/renovate/config", "name": "configmap-renovate-05191200-fd042192", "readOnly": true }, { "mountPath": "/etc/renovate/secret", "name": "secret-renovate-05191200-fd042192-97b80186", "readOnly": true }, { "mountPath": "/etc/pki/ca-trust/extracted/pem", "name": "configmap-trusted-ca-6ct58987ht", "readOnly": true } ] } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "config.js", "path": "config.js" } ], "name": "renovate-05191200-fd042192", "optional": false }, "name": "configmap-renovate-05191200-fd042192" }, { "name": "secret-renovate-05191200-fd042192-97b80186", "secret": { "defaultMode": 420, "items": [ { "key": "renovate-token", "path": "renovate-token" } ], "optional": false, "secretName": "renovate-05191200-fd042192" } }, { "configMap": { "defaultMode": 420, "items": [ { "key": "ca-bundle.crt", "path": "tls-ca-bundle.pem" } ], "name": "trusted-ca-6ct58987ht", "optional": false }, "name": "configmap-trusted-ca-6ct58987ht" } ], "workspaces": [ { "name": "shared-data" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }