{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv?rev=c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "build.appstudio.redhat.com/commit_sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "base-ynjtme", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "7798558", "pipelinesascode.tekton.dev/branch": "base-ynjtme", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85113101793", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-akhmae", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/image-controller-e2e-cdzd/pipelinerun/gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-ynjtme\"", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-quelfu-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/sha-title": "konflux-ci e2e-tests update gh-test-custom-branch-quelfu", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv/commit/c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/source-branch": "konflux-gh-test-custom-branch-quelfu", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-hlhwxv", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "image-controller-e2e-cdzd/results/ef9b87e8-7299-4be5-ad48-202fc6c5d077/records/3080f2bc-8d5a-4c23-bddd-8a7a1b4c8f6c", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-hlhwxv\",\"commit\":\"c88c9281ed8580968c78c75ed1206d8fe7f33cf0\",\"eventType\":\"pull_request\",\"pull_request-id\":2}", "results.tekton.dev/result": "image-controller-e2e-cdzd/results/ef9b87e8-7299-4be5-ad48-202fc6c5d077", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "test.appstudio.openshift.io/pr-group": "konflux-gh-test-custom-branch-quelfu" }, "creationTimestamp": "2026-07-04T07:17:38Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-04T07:20:40Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.48.0", "appstudio.openshift.io/application": "build-suite-test-application-pllz", "appstudio.openshift.io/component": "gh-test-custom-branch-quelfu", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85113101793", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-quelfu-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "ithub-com-redhat-appstudio-qe-devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-hlhwxv", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "tekton.dev/pipelineRun": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "tekton.dev/pipelineRunUID": "ef9b87e8-7299-4be5-ad48-202fc6c5d077", "tekton.dev/pipelineTask": "deprecated-base-image-check", "tekton.dev/task": "deprecated-image-check", "test.appstudio.openshift.io/pr-group-sha": "b281ca4b1585e010708882a16eea7b93b7932afbaf95f9e3d6e019bcbe5163" }, "name": "gh-a4ff1927cb59e797d9995e5f0473d24d-deprecated-base-image-check", "namespace": "image-controller-e2e-cdzd", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "uid": "ef9b87e8-7299-4be5-ad48-202fc6c5d077" } ], "resourceVersion": "19352", "uid": "3080f2bc-8d5a-4c23-bddd-8a7a1b4c8f6c" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0" }, { "name": "IMAGE_DIGEST", "value": "sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d" } ], "serviceAccountName": "build-pipeline-gh-test-custom-branch-quelfu", "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-04T07:17:52Z", "conditions": [ { "lastTransitionTime": "2026-07-04T07:17:52Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gh-a4ff1927cb59e797d9995e5f7922da8142018fcb91a37916ace1d2cd-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, "entryPoint": "deprecated-image-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0\", \"digests\": [\"sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-07-04T07:17:51+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n" } ], "startTime": "2026-07-04T07:17:38Z", "steps": [ { "container": "step-check-images", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "provenance": {}, "terminated": { "containerID": "containerd://9a04a3714af6d8bc6d2d075a4631d9bd4d906cfcef7c0a4731ad185e3d958887", "exitCode": 0, "finishedAt": "2026-07-04T07:17:51Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0\\\", \\\"digests\\\": [\\\"sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-07-04T07:17:51+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-04T07:17:43Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.", "params": [ { "default": "/project/repository/", "description": "Path to directory containing Conftest policies.", "name": "POLICY_DIR", "type": "string" }, { "default": "required_checks", "description": "Namespace for Conftest policy.", "name": "POLICY_NAMESPACE", "type": "string" }, { "default": "", "description": "Digests of base build images.", "name": "BASE_IMAGES_DIGESTS", "type": "string" }, { "description": "Fully qualified image name.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "POLICY_DIR", "value": "/project/repository/" }, { "name": "POLICY_NAMESPACE", "value": "required_checks" }, { "name": "BASE_IMAGES_DIGESTS" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0" }, { "name": "IMAGE_DIGEST", "value": "sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n while read -r arch arch_sha; do\n SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Get base images from SBOM\n if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n echo \"Unable to download sbom for arch $arch.\"\n continue\n fi\n\n \u003c \"${SBOM_FILE_PATH}\" jq -r '\n if .bomFormat == \"CycloneDX\" then\n .formulation[]?\n | .components[]?\n | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n | (\n .purl\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n else\n .packages[]\n | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n | (\n $purls | first\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n end\n ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"Detected base images from $arch SBOM:\"\n cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"\"\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n # Get images from the parameter\n for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n do\n echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n mkdir -p \"${IMAGE_REPO_PATH}\"\n echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n if [ \"$http_code\" == \"200\" ];\n then\n echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${failures_num}\" -gt 0 ]]; then\n echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n fi\n failure_counter=$((failure_counter+failures_num))\n\n successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${successes_num}\" -gt 0 ]]; then\n echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n fi\n success_counter=$((success_counter+successes_num))\n\n elif [ \"$http_code\" == \"404\" ];\n then\n echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n warnings_counter=$((warnings_counter+1))\n else\n echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n error_counter=$((error_counter+1))\n fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n if [[ \"${failure_counter}\" -gt 0 ]]; then\n RES=\"FAILURE\"\n elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n RES=\"WARNING\"\n elif [[ \"${success_counter}\" -eq 0 ]]; then\n # when all counters are 0, there are no base images to check\n note=\"Task deprecated-image-check success: No base images to check.\"\n RES=\"SUCCESS\"\n else\n RES=\"SUCCESS\"\n fi\n TEST_OUTPUT=$(make_result_json \\\n -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv?rev=c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "build.appstudio.redhat.com/commit_sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "base-ynjtme", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "7798558", "pipelinesascode.tekton.dev/branch": "base-ynjtme", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85113101793", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-akhmae", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/image-controller-e2e-cdzd/pipelinerun/gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-ynjtme\"", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-quelfu-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/sha-title": "konflux-ci e2e-tests update gh-test-custom-branch-quelfu", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv/commit/c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/source-branch": "konflux-gh-test-custom-branch-quelfu", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-hlhwxv", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "image-controller-e2e-cdzd/results/ef9b87e8-7299-4be5-ad48-202fc6c5d077/records/fe055358-b926-4dc9-b1d2-fcab172bd1a1", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-hlhwxv\",\"commit\":\"c88c9281ed8580968c78c75ed1206d8fe7f33cf0\",\"eventType\":\"pull_request\",\"pull_request-id\":2}", "results.tekton.dev/result": "image-controller-e2e-cdzd/results/ef9b87e8-7299-4be5-ad48-202fc6c5d077", "results.tekton.dev/stored": "true", "test.appstudio.openshift.io/pr-group": "konflux-gh-test-custom-branch-quelfu" }, "creationTimestamp": "2026-07-04T07:17:38Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-04T07:20:40Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.48.0", "appstudio.openshift.io/application": "build-suite-test-application-pllz", "appstudio.openshift.io/component": "gh-test-custom-branch-quelfu", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85113101793", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-quelfu-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "ithub-com-redhat-appstudio-qe-devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-hlhwxv", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "tekton.dev/pipelineRun": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "tekton.dev/pipelineRunUID": "ef9b87e8-7299-4be5-ad48-202fc6c5d077", "tekton.dev/pipelineTask": "rpms-signature-scan", "tekton.dev/task": "rpms-signature-scan", "test.appstudio.openshift.io/pr-group-sha": "b281ca4b1585e010708882a16eea7b93b7932afbaf95f9e3d6e019bcbe5163" }, "name": "gh-test-cusa4ff1927cb59e797d9995e5f0473d24d-rpms-signature-scan", "namespace": "image-controller-e2e-cdzd", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "uid": "ef9b87e8-7299-4be5-ad48-202fc6c5d077" } ], "resourceVersion": "19351", "uid": "fe055358-b926-4dc9-b1d2-fcab172bd1a1" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0" }, { "name": "image-digest", "value": "sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d" } ], "serviceAccountName": "build-pipeline-gh-test-custom-branch-quelfu", "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:65370ccb44ff82e4ce128addd913f3c96b298607b3760ee1339ed10011a4bd6b" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-04T07:17:55Z", "conditions": [ { "lastTransitionTime": "2026-07-04T07:17:55Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gh-test-cusa4ff1927cb59e7979a20b6e61b8f898e907b20bb14c7de80-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "65370ccb44ff82e4ce128addd913f3c96b298607b3760ee1339ed10011a4bd6b" }, "entryPoint": "rpms-signature-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0\", \"digests\": [\"sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d\"]}}\n" }, { "name": "RPMS_DATA", "type": "string", "value": "{\"keys\": {\"unsigned\": 0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-07-04T07:17:54+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "startTime": "2026-07-04T07:17:39Z", "steps": [ { "container": "step-rpms-signature-scan", "imageID": "quay.io/konflux-ci/tools@sha256:ab906015e70783702b2d1273675009c9e49ef5c4ec7afd80af9886fd3574233c", "name": "rpms-signature-scan", "provenance": {}, "terminated": { "containerID": "containerd://82ba602e84d1c1e9036e74740ef409c6ae04968fe76c820e1a84e1e5a562ae02", "exitCode": 0, "finishedAt": "2026-07-04T07:17:54Z", "reason": "Completed", "startedAt": "2026-07-04T07:17:45Z" }, "terminationReason": "Completed" }, { "container": "step-output-results", "imageID": "quay.io/konflux-ci/konflux-test@sha256:c370a7bc6e172cdbab001f1a19f37ebc95f47c3d8fe2d915fa4641132490ead7", "name": "output-results", "provenance": {}, "terminated": { "containerID": "containerd://6a401f6f830e127c3d3e0338994bb799ab0ad387e3986a10b28d6c3b1d06b57d", "exitCode": 0, "finishedAt": "2026-07-04T07:17:55Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0\\\", \\\"digests\\\": [\\\"sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-07-04T07:17:54+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-04T07:17:54Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans RPMs in an image and provide information about RPMs signatures.", "params": [ { "description": "Image URL", "name": "image-url", "type": "string" }, { "description": "Image digest to scan", "name": "image-digest", "type": "string" }, { "default": "/tmp", "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n", "name": "workdir", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Information about signed and unsigned RPMs", "name": "RPMS_DATA", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "200m", "memory": "256Mi" }, "requests": { "cpu": "200m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0" }, { "name": "IMAGE_DIGEST", "value": "sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d" }, { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/tools@sha256:ab906015e70783702b2d1273675009c9e49ef5c4ec7afd80af9886fd3574233c", "name": "rpms-signature-scan", "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n --image-url \"${IMAGE_URL}\" \\\n --image-digest \"${IMAGE_DIGEST}\" \\\n --workdir \"${WORKDIR}\" \\\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "50m", "memory": "32Mi" }, "requests": { "cpu": "50m", "memory": "32Mi" } }, "env": [ { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/konflux-test:v1.5.2@sha256:c370a7bc6e172cdbab001f1a19f37ebc95f47c3d8fe2d915fa4641132490ead7", "name": "output-results", "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv?rev=c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "build.appstudio.redhat.com/commit_sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "base-ynjtme", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "7798558", "pipelinesascode.tekton.dev/branch": "base-ynjtme", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85113101793", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-akhmae", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/image-controller-e2e-cdzd/pipelinerun/gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-ynjtme\"", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-quelfu-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/sha-title": "konflux-ci e2e-tests update gh-test-custom-branch-quelfu", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv/commit/c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/source-branch": "konflux-gh-test-custom-branch-quelfu", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-hlhwxv", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "image-controller-e2e-cdzd/results/ef9b87e8-7299-4be5-ad48-202fc6c5d077/records/666e387f-1251-4706-aeb3-c3e240f74cf4", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-hlhwxv\",\"commit\":\"c88c9281ed8580968c78c75ed1206d8fe7f33cf0\",\"eventType\":\"pull_request\",\"pull_request-id\":2}", "results.tekton.dev/result": "image-controller-e2e-cdzd/results/ef9b87e8-7299-4be5-ad48-202fc6c5d077", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "test.appstudio.openshift.io/pr-group": "konflux-gh-test-custom-branch-quelfu" }, "creationTimestamp": "2026-07-04T07:17:38Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-04T07:20:40Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.48.0", "appstudio.openshift.io/application": "build-suite-test-application-pllz", "appstudio.openshift.io/component": "gh-test-custom-branch-quelfu", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85113101793", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-quelfu-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "ithub-com-redhat-appstudio-qe-devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-hlhwxv", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "tekton.dev/pipelineRun": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "tekton.dev/pipelineRunUID": "ef9b87e8-7299-4be5-ad48-202fc6c5d077", "tekton.dev/pipelineTask": "sast-unicode-check", "tekton.dev/task": "sast-unicode-check-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "b281ca4b1585e010708882a16eea7b93b7932afbaf95f9e3d6e019bcbe5163" }, "name": "gh-test-custa4ff1927cb59e797d9995e5f0473d24d-sast-unicode-check", "namespace": "image-controller-e2e-cdzd", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "uid": "ef9b87e8-7299-4be5-ad48-202fc6c5d077" } ], "resourceVersion": "19371", "uid": "666e387f-1251-4706-aeb3-c3e240f74cf4" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu@sha256:f18b381c5e04831c3244c6cb4e325f2e3ae0889f9d21e4147a424ee5e0cb49a8" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "serviceAccountName": "build-pipeline-gh-test-custom-branch-quelfu", "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-04T07:17:49Z", "conditions": [ { "lastTransitionTime": "2026-07-04T07:17:49Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gh-test-custa4ff1927cb59e79d35be0f1ab42091a68a31d4a4a4bff0b-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200" }, "entryPoint": "sast-unicode-check-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-07-04T07:17:46+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "startTime": "2026-07-04T07:17:38Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://230dfcfff64519874f7801b8353ac857e449546ce458b08c73e4969c6ec7da72", "exitCode": 0, "finishedAt": "2026-07-04T07:17:44Z", "reason": "Completed", "startedAt": "2026-07-04T07:17:44Z" }, "terminationReason": "Completed" }, { "container": "step-sast-unicode-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-unicode-check", "provenance": {}, "terminated": { "containerID": "containerd://8d5d96e729c4f52a52be25c5ee7c623d43966907769424e0a9be0827d3e14d7f", "exitCode": 0, "finishedAt": "2026-07-04T07:17:46Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-07-04T07:17:46+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-04T07:17:45Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "provenance": {}, "terminated": { "containerID": "containerd://0d1fb1b0d30b43f745ef562342b6c5045986bb1dcd8977dad2a7fc407e003408", "exitCode": 0, "finishedAt": "2026-07-04T07:17:48Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-07-04T07:17:46+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-04T07:17:46Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans source code for non-printable unicode characters in all text files.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "-p bidi -v -d -t", "description": "arguments for find-unicode-control command.", "name": "FIND_UNICODE_CONTROL_ARGS", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "description": "Image digest used for ORAS upload.", "name": "image-digest", "type": "string" }, { "description": "Image URL used for ORAS upload.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu@sha256:f18b381c5e04831c3244c6cb4e325f2e3ae0889f9d21e4147a424ee5e0cb49a8=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "128m", "memory": "256Mi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "FIND_UNICODE_CONTROL_ARGS", "value": "-p bidi -v -d -t" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_CODE_DIR", "value": "/var/workdir" }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-unicode-check", "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n \u003eraw_sast_unicode_check_out.txt \\\n 2\u003eraw_sast_unicode_check_out.log ||\n FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n echo \"Failed to run find-unicode-control command\" \u003e\u00262\n cat raw_sast_unicode_check_out.log\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n --mode=json\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"${SCAN_PROP}\"\n --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n cat processed_sast_unicode_check_out.err\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # Build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n # Append --record-excluded option if RECORD_EXCLUDED is true\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n else\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n echo \"sast-unicode-check test failed because of the following issues:\"\n cat sast_unicode_check_out.json\n TEST_OUTPUT=\n parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0" }, { "name": "IMAGE_DIGEST", "value": "sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n echo 'No image-url param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n MEDIA_TYPE=application/json\n else\n MEDIA_TYPE=application/sarif+json\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv?rev=c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "build.appstudio.redhat.com/commit_sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "build.appstudio.redhat.com/pull_request_number": "2", "build.appstudio.redhat.com/target_branch": "base-ynjtme", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "7798558", "pipelinesascode.tekton.dev/branch": "base-ynjtme", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85113101793", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-akhmae", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/image-controller-e2e-cdzd/pipelinerun/gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-ynjtme\"", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-quelfu-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/secret-created": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/sha-title": "konflux-ci e2e-tests update gh-test-custom-branch-quelfu", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv/commit/c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/source-branch": "konflux-gh-test-custom-branch-quelfu", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-hlhwxv", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "image-controller-e2e-cdzd/results/ef9b87e8-7299-4be5-ad48-202fc6c5d077/records/1b787ca3-361c-4f87-ac7e-6a99962a24b5", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-hlhwxv\",\"commit\":\"c88c9281ed8580968c78c75ed1206d8fe7f33cf0\",\"eventType\":\"pull_request\",\"pull_request-id\":2}", "results.tekton.dev/result": "image-controller-e2e-cdzd/results/ef9b87e8-7299-4be5-ad48-202fc6c5d077", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "virus, konflux", "test.appstudio.openshift.io/pr-group": "konflux-gh-test-custom-branch-quelfu" }, "creationTimestamp": "2026-07-04T07:17:38Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-04T07:20:40Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.48.0", "appstudio.openshift.io/application": "build-suite-test-application-pllz", "appstudio.openshift.io/component": "gh-test-custom-branch-quelfu", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85113101793", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-quelfu-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "2", "pipelinesascode.tekton.dev/repository": "ithub-com-redhat-appstudio-qe-devfile-sample-hello-world-hlhwxv", "pipelinesascode.tekton.dev/sha": "c88c9281ed8580968c78c75ed1206d8fe7f33cf0", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-hlhwxv", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "tekton.dev/pipelineRun": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "tekton.dev/pipelineRunUID": "ef9b87e8-7299-4be5-ad48-202fc6c5d077", "tekton.dev/pipelineTask": "clamav-scan", "tekton.dev/task": "clamav-scan-min", "test.appstudio.openshift.io/pr-group-sha": "b281ca4b1585e010708882a16eea7b93b7932afbaf95f9e3d6e019bcbe5163" }, "name": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg-clamav-scan", "namespace": "image-controller-e2e-cdzd", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gh-test-custom-branch-quelfu-on-pull-request-xxnhg", "uid": "ef9b87e8-7299-4be5-ad48-202fc6c5d077" } ], "resourceVersion": "19356", "uid": "1b787ca3-361c-4f87-ac7e-6a99962a24b5" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0" } ], "serviceAccountName": "build-pipeline-gh-test-custom-branch-quelfu", "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-04T07:19:18Z", "conditions": [ { "lastTransitionTime": "2026-07-04T07:19:18Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gh-test-custom-branch-quelf44a081cd07aac92eb1280ca84c798a52-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, "entryPoint": "clamav-scan-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0\", \"digests\": [\"sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1783149554\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n" } ], "startTime": "2026-07-04T07:17:38Z", "steps": [ { "container": "step-extract-and-scan-image", "imageID": "quay.io/konflux-ci/clamav-db@sha256:c99765a1c1493f281d776f3f589960cb21a344733f36cf7d755479a56edb937b", "name": "extract-and-scan-image", "provenance": {}, "terminated": { "containerID": "containerd://ddafd001cac37dd107c0cacec0c30db68faa8df3add3200d387dc498fa377f97", "exitCode": 0, "finishedAt": "2026-07-04T07:19:14Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0\\\", \\\"digests\\\": [\\\"sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783149554\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-04T07:17:44Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "provenance": {}, "terminated": { "containerID": "containerd://52f1e33f0a9c3e935f4620552ca47e5bb6ae2f6185f4ebb8e3c1d2a1eeab392a", "exitCode": 0, "finishedAt": "2026-07-04T07:19:17Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0\\\", \\\"digests\\\": [\\\"sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783149554\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-04T07:19:14Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image arch.", "name": "image-arch", "type": "string" }, { "default": "", "description": "unused", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "8", "description": "Maximum number of threads clamd runs.", "name": "clamd-max-threads", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-upload", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "512m", "memory": "3Gi" }, "requests": { "cpu": "512m", "memory": "3Gi" } }, "env": [ { "name": "HOME", "value": "/work" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0" }, { "name": "IMAGE_DIGEST", "value": "sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d" }, { "name": "IMAGE_ARCH" }, { "name": "MAX_THREADS", "value": "8" } ], "image": "quay.io/konflux-ci/clamav-db:latest", "name": "extract-and-scan-image", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n mkdir -p ~/.docker\n echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n# $1: destination - path to the content to scan\n# $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n# $3: digest - digest to add to digests_processed array\n# $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n local destination=\"$1\"\n local suffix=\"$2\"\n local digest=\"$3\"\n local scan_message=\"${4:-Scanning content}\"\n\n db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n echo \"$scan_message. This operation may take a while.\"\n clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n digests_processed+=(\"\\\"$digest\\\"\")\n\n if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n # OPA/EC requires structured data input, add clamAV log into json\n jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o json \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o appstudio \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n\n if [ -n \"$raw_manifest\" ]; then\n media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n # Determine if this is an OCI artifact (not a container image)\n # OCI artifacts typically have:\n # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n # - An explicit artifactType field that is not a container image type\n is_oci_artifact=false\n\n # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n is_oci_artifact=true\n fi\n\n # Check if artifactType is set and is not a container image type\n if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n is_oci_artifact=true\n fi\n\n if [ \"$is_oci_artifact\" = true ]; then\n # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n # This looks like a container image manifest, but get_image_manifests failed\n echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n else\n # Likely an OCI artifact with non-standard media type\n echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n fi\n else\n echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n echo \"Detected container image. Processing image manifests.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n # Proceed only if a specific arch is provided.\n # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n if [ -n \"$IMAGE_ARCH\" ]; then\n arch=\"${IMAGE_ARCH#*/}\"\n if [ \"${arch}\" = \"x86_64\" ]; then\n arch=\"amd64\"\n fi\n\n # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n arch=\"amd64\"\n ;;\n esac\n\n image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n fi\n\n while read -r arch arch_sha; do\n destination=\"content-${arch}\"\n mkdir -p \"$destination\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n exit 0\n fi\n\n # Scan and process container image for this architecture\n scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n {\n \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n \"namespace\" : $item.namespace,\n \"successes\" : (.successes + $item.successes),\n \"failures\" : (.failures + $item.failures),\n \"warnings\" : (.warnings + $item.warnings),\n \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_UPLOAD", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/image-controller-e2e-cdzd/gh-test-custom-branch-quelfu:on-pr-c88c9281ed8580968c78c75ed1206d8fe7f33cf0" }, { "name": "IMAGE_DIGEST", "value": "sha256:2c124ceb3031145902cb369cd8e060f50ead409a1ca97db8d71f000d7e767e7d" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n echo \"Upload skipped by parameter.\"\n exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n MEDIA_TYPE=text/vnd.clamav\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n MEDIA_TYPE=application/vnd.konflux.test_output+json\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n echo \"No files found. Skipping upload.\"\n exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n", "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" } ], "volumes": [ { "emptyDir": {}, "name": "dbfolder" }, { "emptyDir": {}, "name": "work" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }