{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv?rev=98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "build.appstudio.redhat.com/commit_sha": "98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "base-dntayi", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "7798558", "pipelinesascode.tekton.dev/branch": "base-dntayi", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "84676802672", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-lsoemm", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/image-controller-e2e-tvjk/pipelinerun/gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-dntayi\"", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-mspmcg-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "pipelinesascode.tekton.dev/sha-title": "konflux-ci e2e-tests update gh-test-custom-branch-mspmcg", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv/commit/98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "pipelinesascode.tekton.dev/source-branch": "konflux-gh-test-custom-branch-mspmcg", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-kooypv", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "image-controller-e2e-tvjk/results/a07add0e-1b60-4d1a-bd7c-8991fbd764dc/records/c4121d23-a9e0-42dd-a46d-e59d77abcf11", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-kooypv\",\"commit\":\"98dc4e048676b8fbc3eea5279e679e3eb64b0be0\",\"eventType\":\"pull_request\",\"pull_request-id\":2}", "results.tekton.dev/result": "image-controller-e2e-tvjk/results/a07add0e-1b60-4d1a-bd7c-8991fbd764dc", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "test.appstudio.openshift.io/pr-group": "konflux-gh-test-custom-branch-mspmcg" }, "creationTimestamp": "2026-07-02T02:12:55Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-02T02:16:02Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.48.0", "appstudio.openshift.io/application": "build-suite-test-application-bcyq", "appstudio.openshift.io/component": "gh-test-custom-branch-mspmcg", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "84676802672", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-mspmcg-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "ithub-com-redhat-appstudio-qe-devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/sha": "98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-kooypv", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "tekton.dev/pipelineRun": "gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "tekton.dev/pipelineRunUID": "a07add0e-1b60-4d1a-bd7c-8991fbd764dc", "tekton.dev/pipelineTask": "build-image-index", "tekton.dev/task": "build-image-index-min", "test.appstudio.openshift.io/pr-group-sha": "de83262370fe2490dab02c99382499cac5a9df157413a791bbde6942b02d14" }, "name": "gh-test-custod9010b93cfa94850bd98d8320ddd9de2-build-image-index", "namespace": "image-controller-e2e-tvjk", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "uid": "a07add0e-1b60-4d1a-bd7c-8991fbd764dc" } ], "resourceVersion": "18823", "uid": "c4121d23-a9e0-42dd-a46d-e59d77abcf11" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "serviceAccountName": "build-pipeline-gh-test-custom-branch-mspmcg", "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:1b32874e3638e0c772479d513e49d6c6c3268cf88ae89966cb9724f3c06cc96b" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-02T02:13:08Z", "conditions": [ { "lastTransitionTime": "2026-07-02T02:13:08Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gh-test-custod9010b93cfa948241e3b7cc19e673aa4e7393739d75724-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "1b32874e3638e0c772479d513e49d6c6c3268cf88ae89966cb9724f3c06cc96b" }, "entryPoint": "build-image-index-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min" } }, "results": [ { "name": "IMAGES", "type": "string", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14" }, { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0" } ], "startTime": "2026-07-02T02:12:55Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "provenance": {}, "terminated": { "containerID": "containerd://e69928ae9297598b34d7b83d2e73cb188a658f28274195b178a9c12bc3e273cf", "exitCode": 0, "finishedAt": "2026-07-02T02:13:03Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-02T02:12:59Z" }, "terminationReason": "Completed" }, { "container": "step-create-sbom", "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "provenance": {}, "terminated": { "containerID": "containerd://deced6ca2f57f03eb589d63f431bb00873c134b1e7eb17098a3b9aa42f56f50e", "exitCode": 0, "finishedAt": "2026-07-02T02:13:03Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-02T02:13:03Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "containerd://52ab6fe788c08bcd2e61eb28418d1f6a1c6a9c11db83b39978bd6650cf362cdb", "exitCode": 0, "finishedAt": "2026-07-02T02:13:07Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-02T02:13:04Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This takes existing Image Manifests and combines them in an Image Index.", "params": [ { "description": "The target image and tag where the image will be pushed to.", "name": "IMAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "description": "List of Image Manifests to be referenced by the Image Index", "name": "IMAGES", "type": "array" }, { "default": "true", "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.", "name": "ALWAYS_BUILD_INDEX", "type": "string" }, { "default": "vfs", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": "false", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "List of all referenced image manifests", "name": "IMAGES", "type": "string" }, { "description": "Image reference of the built image containing both the repository and the digest", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "vfs" } ], "volumeMounts": [ { "mountPath": "/index-build-data", "name": "shared-dir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n --image \"$IMAGE\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --buildah-format \"$BUILDAH_FORMAT\" \\\n --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n --additional-tags \"gh-test-custod9010b93cfa94850bd98d8320ddd9de2-build-image-index\" \\\n --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n --result-path-images \"/tekton/results/IMAGES\" \\\n --images \"$@\"; then\n echo \"Failed to build image index\"\n exit 1\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-index\n --index-image-pullspec \"$IMAGE_URL\"\n --index-image-digest \"$IMAGE_DIGEST\"\n --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 } } ], "volumes": [ { "emptyDir": {}, "name": "shared-dir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv?rev=98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "build.appstudio.redhat.com/commit_sha": "98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "base-dntayi", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "7798558", "pipelinesascode.tekton.dev/branch": "base-dntayi", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "84676802672", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-lsoemm", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/image-controller-e2e-tvjk/pipelinerun/gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-dntayi\"", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-mspmcg-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "pipelinesascode.tekton.dev/sha-title": "konflux-ci e2e-tests update gh-test-custom-branch-mspmcg", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv/commit/98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "pipelinesascode.tekton.dev/source-branch": "konflux-gh-test-custom-branch-mspmcg", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-kooypv", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "image-controller-e2e-tvjk/results/a07add0e-1b60-4d1a-bd7c-8991fbd764dc/records/f0920a39-f90c-4983-a3e9-ef4dc8c298ed", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-kooypv\",\"commit\":\"98dc4e048676b8fbc3eea5279e679e3eb64b0be0\",\"eventType\":\"pull_request\",\"pull_request-id\":2}", "results.tekton.dev/result": "image-controller-e2e-tvjk/results/a07add0e-1b60-4d1a-bd7c-8991fbd764dc", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "virus, konflux", "test.appstudio.openshift.io/pr-group": "konflux-gh-test-custom-branch-mspmcg" }, "creationTimestamp": "2026-07-02T02:13:08Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-02T02:16:02Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.48.0", "appstudio.openshift.io/application": "build-suite-test-application-bcyq", "appstudio.openshift.io/component": "gh-test-custom-branch-mspmcg", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "84676802672", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-mspmcg-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "ithub-com-redhat-appstudio-qe-devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/sha": "98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-kooypv", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "tekton.dev/pipelineRun": "gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "tekton.dev/pipelineRunUID": "a07add0e-1b60-4d1a-bd7c-8991fbd764dc", "tekton.dev/pipelineTask": "clamav-scan", "tekton.dev/task": "clamav-scan-min", "test.appstudio.openshift.io/pr-group-sha": "de83262370fe2490dab02c99382499cac5a9df157413a791bbde6942b02d14" }, "name": "gh-test-custom-branch-mspmcg-on-pull-request-n2qgz-clamav-scan", "namespace": "image-controller-e2e-tvjk", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "uid": "a07add0e-1b60-4d1a-bd7c-8991fbd764dc" } ], "resourceVersion": "18822", "uid": "f0920a39-f90c-4983-a3e9-ef4dc8c298ed" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0" } ], "serviceAccountName": "build-pipeline-gh-test-custom-branch-mspmcg", "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-02T02:14:51Z", "conditions": [ { "lastTransitionTime": "2026-07-02T02:14:51Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gh-test-custom-branch-mspmc9cf44e815e4283232eae482aeefff8ca-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, "entryPoint": "clamav-scan-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0\", \"digests\": [\"sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1782958486\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n" } ], "startTime": "2026-07-02T02:13:08Z", "steps": [ { "container": "step-extract-and-scan-image", "imageID": "quay.io/konflux-ci/clamav-db@sha256:2da6c1a37fef998b68b675505fb654b1123e3cd889c190c59b4527d11621e8fc", "name": "extract-and-scan-image", "provenance": {}, "terminated": { "containerID": "containerd://ebee70ff77bd177cc3997b7ef756d85491068f475efc4640363a33122a90ac00", "exitCode": 0, "finishedAt": "2026-07-02T02:14:47Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0\\\", \\\"digests\\\": [\\\"sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1782958486\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-02T02:13:14Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "provenance": {}, "terminated": { "containerID": "containerd://16a08958d6340b38904845522e204b82d90fabdef555bc2a5ac770acaa294442", "exitCode": 0, "finishedAt": "2026-07-02T02:14:50Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0\\\", \\\"digests\\\": [\\\"sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1782958486\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-02T02:14:47Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image arch.", "name": "image-arch", "type": "string" }, { "default": "", "description": "unused", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "8", "description": "Maximum number of threads clamd runs.", "name": "clamd-max-threads", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-upload", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "512m", "memory": "3Gi" }, "requests": { "cpu": "512m", "memory": "3Gi" } }, "env": [ { "name": "HOME", "value": "/work" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0" }, { "name": "IMAGE_DIGEST", "value": "sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14" }, { "name": "IMAGE_ARCH" }, { "name": "MAX_THREADS", "value": "8" } ], "image": "quay.io/konflux-ci/clamav-db:latest", "name": "extract-and-scan-image", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n mkdir -p ~/.docker\n echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n# $1: destination - path to the content to scan\n# $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n# $3: digest - digest to add to digests_processed array\n# $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n local destination=\"$1\"\n local suffix=\"$2\"\n local digest=\"$3\"\n local scan_message=\"${4:-Scanning content}\"\n\n db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n echo \"$scan_message. This operation may take a while.\"\n clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n digests_processed+=(\"\\\"$digest\\\"\")\n\n if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n # OPA/EC requires structured data input, add clamAV log into json\n jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o json \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o appstudio \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n\n if [ -n \"$raw_manifest\" ]; then\n media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n # Determine if this is an OCI artifact (not a container image)\n # OCI artifacts typically have:\n # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n # - An explicit artifactType field that is not a container image type\n is_oci_artifact=false\n\n # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n is_oci_artifact=true\n fi\n\n # Check if artifactType is set and is not a container image type\n if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n is_oci_artifact=true\n fi\n\n if [ \"$is_oci_artifact\" = true ]; then\n # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n # This looks like a container image manifest, but get_image_manifests failed\n echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n else\n # Likely an OCI artifact with non-standard media type\n echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n fi\n else\n echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n echo \"Detected container image. Processing image manifests.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n # Proceed only if a specific arch is provided.\n # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n if [ -n \"$IMAGE_ARCH\" ]; then\n arch=\"${IMAGE_ARCH#*/}\"\n if [ \"${arch}\" = \"x86_64\" ]; then\n arch=\"amd64\"\n fi\n\n # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n arch=\"amd64\"\n ;;\n esac\n\n image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n fi\n\n while read -r arch arch_sha; do\n destination=\"content-${arch}\"\n mkdir -p \"$destination\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n exit 0\n fi\n\n # Scan and process container image for this architecture\n scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n {\n \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n \"namespace\" : $item.namespace,\n \"successes\" : (.successes + $item.successes),\n \"failures\" : (.failures + $item.failures),\n \"warnings\" : (.warnings + $item.warnings),\n \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_UPLOAD", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0" }, { "name": "IMAGE_DIGEST", "value": "sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n echo \"Upload skipped by parameter.\"\n exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n MEDIA_TYPE=text/vnd.clamav\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n MEDIA_TYPE=application/vnd.konflux.test_output+json\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n echo \"No files found. Skipping upload.\"\n exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n", "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" } ], "volumes": [ { "emptyDir": {}, "name": "dbfolder" }, { "emptyDir": {}, "name": "work" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv?rev=98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "build.appstudio.redhat.com/commit_sha": "98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "base-dntayi", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "7798558", "pipelinesascode.tekton.dev/branch": "base-dntayi", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "84676802672", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-lsoemm", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/image-controller-e2e-tvjk/pipelinerun/gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-dntayi\"", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-mspmcg-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "pipelinesascode.tekton.dev/sha-title": "konflux-ci e2e-tests update gh-test-custom-branch-mspmcg", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv/commit/98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "pipelinesascode.tekton.dev/source-branch": "konflux-gh-test-custom-branch-mspmcg", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-kooypv", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "image-controller-e2e-tvjk/results/a07add0e-1b60-4d1a-bd7c-8991fbd764dc/records/a57d5217-1c6b-435b-854f-47befa60c121", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-kooypv\",\"commit\":\"98dc4e048676b8fbc3eea5279e679e3eb64b0be0\",\"eventType\":\"pull_request\",\"pull_request-id\":2}", "results.tekton.dev/result": "image-controller-e2e-tvjk/results/a07add0e-1b60-4d1a-bd7c-8991fbd764dc", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "test.appstudio.openshift.io/pr-group": "konflux-gh-test-custom-branch-mspmcg" }, "creationTimestamp": "2026-07-02T02:10:07Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-02T02:16:02Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.48.0", "appstudio.openshift.io/application": "build-suite-test-application-bcyq", "appstudio.openshift.io/component": "gh-test-custom-branch-mspmcg", "build.appstudio.redhat.com/build_type": "docker", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "84676802672", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-mspmcg-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "ithub-com-redhat-appstudio-qe-devfile-sample-hello-world-kooypv", "pipelinesascode.tekton.dev/sha": "98dc4e048676b8fbc3eea5279e679e3eb64b0be0", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-kooypv", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "tekton.dev/pipelineRun": "gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "tekton.dev/pipelineRunUID": "a07add0e-1b60-4d1a-bd7c-8991fbd764dc", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "de83262370fe2490dab02c99382499cac5a9df157413a791bbde6942b02d14" }, "name": "gh-test-custom-d9010b93cfa94850bd98d8320ddd9de2-build-container", "namespace": "image-controller-e2e-tvjk", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gh-test-custom-branch-mspmcg-on-pull-request-n2qgz", "uid": "a07add0e-1b60-4d1a-bd7c-8991fbd764dc" } ], "resourceVersion": "18846", "uid": "a57d5217-1c6b-435b-854f-47befa60c121" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0" }, { "name": "DOCKERFILE", "value": "docker/Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "5d" }, { "name": "COMMIT_SHA", "value": "98dc4e048676b8fbc3eea5279e679e3eb64b0be0" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:dcfa5ed52b00a47eac0b4a21bb3cfdcdc8540aeda02150b5aa16d28b10907b2c" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "serviceAccountName": "build-pipeline-gh-test-custom-branch-mspmcg", "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.10@sha256:4f204749ffad747f7612226e3dc52688fc84f3b7a80c5e40d53a05494413176a" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-02T02:12:55Z", "conditions": [ { "lastTransitionTime": "2026-07-02T02:12:55Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gh-test-custom-d9010b93cfa9cb099ecc45adcf43d1522c56afb5f307-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "4f204749ffad747f7612226e3dc52688fc84f3b7a80c5e40d53a05494413176a" }, "entryPoint": "buildah-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min" } }, "results": [ { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0" }, { "name": "SBOM_BLOB_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:09d0d4fb18410b19894cce461cbc3c7a147c821fde02a6b36741b5412fbc4d8f" } ], "startTime": "2026-07-02T02:10:07Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://c93953fc93a7c646e1ad7d6c15f54d241079dfcefb02f111d077f53bd7987a86", "exitCode": 0, "finishedAt": "2026-07-02T02:10:16Z", "reason": "Completed", "startedAt": "2026-07-02T02:10:15Z" }, "terminationReason": "Completed" }, { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:7881de18a51416bb20548a23897225a14f4301c78663531d8c78b7f8af249747", "name": "build", "provenance": {}, "terminated": { "containerID": "containerd://f5cbaae5f10e08f90c5b751f1f7cc915228e360dafa80fcf145e14bede10e259", "exitCode": 0, "finishedAt": "2026-07-02T02:10:34Z", "reason": "Completed", "startedAt": "2026-07-02T02:10:16Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:7881de18a51416bb20548a23897225a14f4301c78663531d8c78b7f8af249747", "name": "push", "provenance": {}, "terminated": { "containerID": "containerd://7606a4ec82dd75e4a02bb1b2d1d359f4532b7957f964a45283561eeb06ceadb8", "exitCode": 0, "finishedAt": "2026-07-02T02:11:24Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-02T02:10:35Z" }, "terminationReason": "Completed" }, { "container": "step-sbom-syft-generate", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "provenance": {}, "terminated": { "containerID": "containerd://840f3980ab621f69715675daaed8761e84159a2828e2ef045b0f9112d382d93c", "exitCode": 0, "finishedAt": "2026-07-02T02:11:44Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-02T02:11:25Z" }, "terminationReason": "Completed" }, { "container": "step-prepare-sboms", "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "provenance": {}, "terminated": { "containerID": "containerd://5b1974d4f1f5ad1af91695fe4d2d381c2eafdb9188d310b2b276b820ca81960a", "exitCode": 0, "finishedAt": "2026-07-02T02:12:14Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-02T02:11:44Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "containerd://73daee9d5091d4e9274a2cb75dd66dd58787d8aa1abee1879a0b6682f6b59786", "exitCode": 0, "finishedAt": "2026-07-02T02:12:55Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0@sha256:b41ada55a1091b165a58271aa52efaa2b6f7f9d129d93255f86c383238604e14\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:09d0d4fb18410b19894cce461cbc3c7a147c821fde02a6b36741b5412fbc4d8f\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-02T02:12:14Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": "info", "description": "Log level for the build command.", "name": "LOG_LEVEL", "type": "string" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "ADD_CAPABILITIES" }, { "name": "ANNOTATIONS_FILE" }, { "name": "BUILD_ARGS_FILE" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXT", "value": "." }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "HERMETIC", "value": "false" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg:on-pr-98dc4e048676b8fbc3eea5279e679e3eb64b0be0" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "5d" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SKIP_INJECTIONS", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "SQUASH", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "TARGET_STAGE" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/image-controller-e2e-tvjk/gh-test-custom-branch-mspmcg@sha256:dcfa5ed52b00a47eac0b4a21bb3cfdcdc8540aeda02150b5aa16d28b10907b2c=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "--build-args", "--envs", "--labels", "--annotations" ], "computeResources": { "limits": { "cpu": "500m", "memory": "1Gi" }, "requests": { "cpu": "500m", "memory": "1Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "98dc4e048676b8fbc3eea5279e679e3eb64b0be0" }, { "name": "SOURCE_URL", "value": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-kooypv" }, { "name": "DOCKERFILE", "value": "docker/Dockerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:7881de18a51416bb20548a23897225a14f4301c78663531d8c78b7f8af249747", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n echo \"[$(date --utc -Ins)] Update CA trust\"\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Delete policy settings for Red Hat registries to disable signature verification.\n# TODO: don't do this?\ncontainer_policy=$(\n jq '.transports |= (\n del(.docker.[\"registry.access.redhat.com\"]) |\n del(.docker.[\"registry.redhat.io\"]) |\n if (.docker == {}) then del(.docker) else . end\n )' /etc/containers/policy.json\n)\necho \"Effective container policy:\"\nprintf '%s\\n' \"$container_policy\" | tee /etc/containers/policy.json\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\necho \"[$(date --utc -Ins)] Run the build\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n ANNOTATIONS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\")\nfi\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILD_ARGS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nsecurity_args=(--security-opts unmask=/proc/interrupts)\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n security_args+=(--security-opts label=disable)\n security_args+=(--cap-add all)\n security_args+=(--devices /dev/fuse)\nfi\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n security_args+=(--cap-add \"${ADD_CAPABILITIES}\")\nfi\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n prefetch_dir=\"/var/workdir/cachi2\"\n # KBC defaults to ${prefetch_dir}/copy-*\n # Copy to a sibling dir instead in case we don't have write permissions to the prefetch_dir.\n # It's still on the same filesystem, so copying via reflinks should be possible.\n prefetch_dir_copy=\"/var/workdir/prefetch-copy\"\nelse\n prefetch_dir=\"\"\n prefetch_dir_copy=\"\"\nfi\n\nyum_repos_d_sources=()\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n yum_repos_d_sources+=(\"${YUM_REPOS_D_FETCHED}\")\nfi\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n yum_repos_d_sources+=(\"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\")\nfi\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 4. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# to \"/etc/pki/entitlement\" to prevent certificates from being included\nrhsm_args=()\nif [ \"${HERMETIC}\" != \"true\" ]; then\n if [ -e /activation-key/org ]; then\n rhsm_args+=(--rhsm-activation-key=/activation-key/activationkey\n --rhsm-org=/activation-key/org\n --rhsm-activation-mount=/activation-key)\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n rhsm_args+=(--rhsm-activation-preregister)\n fi\n elif find /entitlement -name \"*.pem\" \u003e/dev/null; then\n rhsm_args+=(--rhsm-entitlements=/entitlement)\n fi\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\ncmd=(\n konflux-build-cli image build\n -f \"$dockerfile_path\" -t \"$IMAGE\" --source \"$SOURCE_CODE_DIR\" --context \"$CONTEXT\"\n --secret-dirs \"src=/additional-secret,name=$ADDITIONAL_SECRET,optional=true\"\n --workdir-mount \"$WORKINGDIR_MOUNT\"\n --target \"$TARGET_STAGE\"\n --inherit-labels=\"$INHERIT_BASE_IMAGE_LABELS\"\n --source-date-epoch \"$BUILDAH_SOURCE_DATE_EPOCH\"\n --rewrite-timestamp=\"$BUILDAH_REWRITE_TIMESTAMP\"\n --squash=\"$SQUASH\"\n --omit-history=\"$BUILDAH_OMIT_HISTORY\"\n --image-source \"$SOURCE_URL\"\n --image-revision \"$COMMIT_SHA\"\n --quay-image-expires-after \"$IMAGE_EXPIRES_AFTER\"\n --build-args-file \"$BUILD_ARGS_FILE\"\n --annotations-file \"$ANNOTATIONS_FILE\"\n --legacy-build-timestamp \"$BUILD_TIMESTAMP\"\n --add-legacy-labels\n --include-legacy-buildinfo-path=\"$ICM_KEEP_COMPAT_LOCATION\"\n --skip-injections=\"$SKIP_INJECTIONS\"\n --skip-unused-stages=\"$SKIP_UNUSED_STAGES\"\n --hermetic=\"$HERMETIC\"\n --image-pull-proxy \"$BUILDAH_HTTP_PROXY\"\n --image-pull-noproxy \"$BUILDAH_NO_PROXY\"\n --yum-repos-d-sources \"${yum_repos_d_sources[@]}\"\n --yum-repos-d-target \"$YUM_REPOS_D_TARGET\"\n --prefetch-dir \"$prefetch_dir\"\n --prefetch-dir-copy \"$prefetch_dir_copy\"\n --prefetch-env-mount /cachi2/cachi2.env\n --prefetch-output-mount /cachi2/output\n \"${security_args[@]}\"\n \"${rhsm_args[@]}\"\n --containerfile-json-output /shared/parsed_dockerfile.json\n --resolved-base-images-output /shared/base_images_digests\n --no-cache\n --ulimits nofile=4096:4096\n --src-tls-verify=\"$TLSVERIFY\"\n --dest-tls-verify=\"$TLSVERIFY\"\n \"$@\" # --annotations, --labels, --envs, --build-args\n)\n\necho \"[$(date --utc -Ins)] $(printf '%q ' \"${cmd[@]}\")\"\n\n\"${cmd[@]}\"\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"${prefetch_dir}/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp \"${prefetch_dir}/output/bom.json\" ./sbom-prefetch.json\nfi\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "gh-test-custom-d9010b93cfa94850bd98d8320ddd9de2-build-container" } ], "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:7881de18a51416bb20548a23897225a14f4301c78663531d8c78b7f8af249747", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"; then\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n echo -n \"${IMAGE}@\"\n cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e/shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "256m", "memory": "512Mi" }, "requests": { "cpu": "256m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n syft_sbom_type=cyclonedx-json@1.5\n ;;\nspdx)\n syft_sbom_type=spdx-json@2.3\n ;;\n*)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ADDITIONAL_BASE_IMAGES+=(\"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/var/workdir/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "emptyDir": {}, "name": "shared" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "workdir" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }