{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/874f8ecd-b06f-4f21-827b-4d10efeb1b33", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:21:37Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "apply-mapping", "tekton.dev/task": "apply-mapping" }, "name": "managed-w9dpl-apply-mapping", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "11813", "uid": "874f8ecd-b06f-4f21-827b-4d10efeb1b33" }, "spec": { "params": [ { "name": "failOnEmptyResult", "value": "true" }, { "name": "dataPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json" }, { "name": "snapshotPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:0b466275483c00bfeef00d44b1cf2ea4a4bf89fbde6f6d6baef8cdfccd58419f" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" } ], "retries": 3, "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/apply-mapping/apply-mapping.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:21:46Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:21:46Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-apply-mapping-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/apply-mapping/apply-mapping.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "mapped", "type": "string", "value": "true" }, { "name": "sourceDataArtifact", "type": "string", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:3faaf3250d4c648fad4aac6ccdf96029714b37270c570fc64495f70025849a11" } ], "startTime": "2026-07-03T12:21:37Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://8da0f62295b6cfcea8bd20ad42c74624bc0d6bf0a76abc3f8cceda68a92a5076", "exitCode": 0, "finishedAt": "2026-07-03T12:21:42Z", "reason": "Completed", "startedAt": "2026-07-03T12:21:41Z" }, "terminationReason": "Completed" }, { "container": "step-apply-mapping", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "apply-mapping", "provenance": {}, "terminated": { "containerID": "containerd://54c5ead061ff8ae3db24bbacca18989bdf05c9e73c2a1975db19c8f8e985f958", "exitCode": 0, "finishedAt": "2026-07-03T12:21:45Z", "message": "[{\"key\":\"mapped\",\"value\":\"true\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:42Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://f62a2011dddb028ef02847e8ed8500351071d1bb0543f3c8eff2cff0b20e2476", "exitCode": 0, "finishedAt": "2026-07-03T12:21:45Z", "message": "[{\"key\":\"mapped\",\"value\":\"true\",\"type\":1},{\"key\":\"sourceDataArtifact\",\"value\":\"oci:quay-service.quay/test-org/trusted-artifacts@sha256:3faaf3250d4c648fad4aac6ccdf96029714b37270c570fc64495f70025849a11\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:45Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task to apply a mapping to a Snapshot.\n\nThe purpose of this task is to merge a mapping with the components contained in a Snapshot.\nThe mapping is expected to be present in the data field of the ReleasePlanAdmission provided in\nthe `releasePlanAdmissionPath`. If the data field does not contain a `mapping` key, the original\nSnapshot is returned. If there is a `mapping` key, it is merged with the `components` key in the\nSnapshot based on component name.\n\nA `mapped` result is also returned from this task containing a simple true/false value that is\nmeant to inform whether a mapped Snapshot is being returned or the original one.\n\nThis task supports variable expansion in tag values from the mapping. The currently supported variables are:\n* \"{{ timestamp }}\" -\u003e The build-date label from the image in the format provided by timestampFormat or %s as the\n default.\n If the build-date label is not available, we use the Created field in the image metadata as a fallback.\n* \"{{ release_timestamp }}\" -\u003e The current time in the format provided by timestampFormat or %s as the default\n* \"{{ git_sha }}\" -\u003e The git sha that triggered the snapshot being processed\n* \"{{ git_short_sha }}\" -\u003e The git sha reduced to 7 characters\n* \"{{ digest_sha }}\" -\u003e The image digest of the respective component\n* \"{{ incrementer }}\" -\u003e Automatically finds the highest existing incremented tag in the\n repository and generates the next sequential tag (e.g., if the highest tag is v1.0.0-2, it will generate v1.0.0-3)\n* \"{{ component-incrementer }}\" -\u003e Like {{ incrementer }}, but finds the highest existing tag\n across ALL repositories in the component and generates the next sequential tag uniformly.\n Use this instead of {{ incrementer }} when pushing to multiple registries to ensure every\n registry receives the same tag (e.g., if repo-a has v1.0.0-3 and repo-b has v1.0.0-5,\n both will receive v1.0.0-6).\n* \"{{ oci_version }}\" -\u003e The version from OCI image annotations (org.opencontainers.image.version), with fallback\n to OCI image labels if not present in annotations (converts + to _ for tag compliance)\n\nYou can also expand image labels, e.g. \"{{ labels.mylabel }}\" -\u003e The value of image label \"mylabel\"", "params": [ { "description": "Path to the JSON string of the Snapshot spec in the config workspace to apply the mapping to", "name": "snapshotPath", "type": "string" }, { "description": "Path to the JSON string of the merged data to use in the data workspace", "name": "dataPath", "type": "string" }, { "default": "false", "description": "Fail the task if the resulting snapshot contains 0 components", "name": "failOnEmptyResult", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "false", "description": "When \"true\", for each repository the resolved {{ timestamp }} value is added to the list of\ntags after translation (deduplicated). Fails if timestamp is empty. Only pipelines referencing\nthe check-labels task should set this to \"true\"\n", "name": "addImplicitTimestampTag", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "A true/false value depicting whether or not the snapshot was mapped.", "name": "mapped", "type": "string" }, { "description": "Produced trusted data artifact", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:0b466275483c00bfeef00d44b1cf2ea4a4bf89fbde6f6d6baef8cdfccd58419f=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "1", "memory": "64Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "apply-mapping", "script": "#!/usr/bin/env bash\nset -euxo pipefail\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\nSNAPSHOT_SPEC_FILE=\"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json\"\nDATA_FILE=\"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\"\nSNAPSHOT_SPEC_FILE_ORIG=\"${SNAPSHOT_SPEC_FILE}.orig\"\n\nif [ ! -f \"${SNAPSHOT_SPEC_FILE}\" ] ; then\n echo \"No valid snapshot file was found.\"\n exit 1\nfi\n\n# Copy the original Snapshot spec file before overriding\ncp \"${SNAPSHOT_SPEC_FILE}\" \"${SNAPSHOT_SPEC_FILE_ORIG}\"\n\nif [ ! -f \"${DATA_FILE}\" ] ; then\n echo \"No data JSON file was found.\"\n printf \"false\" | tee \"/tekton/results/mapped\"\n exit 0\nfi\n\nMAPPING=$(jq '.mapping' \"${DATA_FILE}\")\n\nif [[ $MAPPING == \"null\" ]] ; then\n echo \"Data file contains no mapping key.\"\n printf \"false\" | tee \"/tekton/results/mapped\"\n exit 0\nfi\n\n# Function to handle incrementer logic\nincrement_tag() {\n local tag_template=\"$1\"\n local repo=\"$2\"\n\n # Use `skopeo list-tags` to fetch all tags from the repository\n existing_tags=$(skopeo list-tags --retry-times 3 docker://\"${repo}\" | jq -r '.Tags[]')\n\n # Remove `{{ incrementer }}` placeholder to get the version prefix for regex pattern\n # shellcheck disable=SC2001\n version_prefix=$(echo \"${tag_template}\" | sed 's/{{ incrementer }}//g')\n # Match tags with 1–6 digit increments only. Ignore 7+ digit tags to avoid\n # treating short commit SHAs as incrementer values\n tag_pattern=\"^${version_prefix}[0-9]{1,6}$\"\n\n # Extract the numeric part of existing tags and find the max increment\n max_increment=$(echo \"${existing_tags}\" | { grep -E \"${tag_pattern}\" || true; } \\\n | sed -E \"s/${version_prefix}//\" | sort -nr | head -n1)\n\n # Calculate the next increment (default to 1 if max_increment is empty or unset)\n # Use 10# to force decimal input preventing leading 0 from being treated as octal\n increment=$((10#${max_increment:-0} + 1))\n\n # Substitute `{{ incrementer }}` in the tag template with the calculated increment\n tag=\"${tag_template//\\{\\{ incrementer \\}\\}/${increment}}\"\n\n # Validate the final tag format to avoid malformed tags\n if [[ ! \"${tag}\" =~ ^[a-zA-Z0-9._-]+$ ]]; then\n echo \"Error: Invalid tag format after substitution: ${tag}\"\n exit 1\n fi\n\n echo \"$tag\" # Return the final tag\n}\n\n# Function to handle component-incrementer logic: finds the highest increment across\n# ALL repositories in a component and returns the next uniform sequential tag.\n# Results are cached by version_prefix to avoid redundant skopeo calls.\n# Expected arguments are: [tag_template, all_repos_json]\ncomponent_increment_tag() {\n local tag_template=\"$1\"\n local all_repos_json=\"${2:-[]}\"\n\n # Remove {{ component-incrementer }} placeholder to get the version prefix\n local version_prefix\n # shellcheck disable=SC2001\n version_prefix=$(echo \"${tag_template}\" | sed 's/{{ *component-incrementer *}}//g')\n\n # Return cached result if available for this prefix.\n # Cache files survive subshell boundaries; associative arrays do not.\n local cache_key\n cache_key=$(printf '%s' \"${version_prefix}\" | base64 | tr -d '=\\n' | tr '+/' '-_')\n local cache_file=\"${_inc_cache_dir}/${cache_key}\"\n if [[ -f \"${cache_file}\" ]]; then\n local cached_increment\n cached_increment=$(\u003c \"${cache_file}\")\n local tag\n # shellcheck disable=SC2001\n tag=$(echo \"${tag_template}\" | sed \"s/{{ *component-incrementer *}}/${cached_increment}/g\")\n if [[ ! \"${tag}\" =~ ^[a-zA-Z0-9._-]+$ ]]; then\n echo \"Error: Invalid tag format after substitution: ${tag}\" \u003e\u00262\n exit 1\n fi\n echo \"$tag\"\n return\n fi\n\n # Escape version_prefix for safe use in ERE (grep -E) and sed -E.\n # Without escaping, a prefix like \"v1.0.0-\" would treat the dots as\n # regex wildcards, potentially matching unintended tags.\n local escaped_prefix\n # shellcheck disable=SC2016\n escaped_prefix=$(printf '%s' \"${version_prefix}\" | sed 's/[.[\\\\*^$()+?{|]/\\\\\u0026/g')\n\n # Match tags with 1–6 digit increments only. Ignore 7+ digit tags to avoid\n # treating short commit SHAs as incrementer values\n local tag_pattern=\"^${escaped_prefix}[0-9]{1,6}$\"\n\n # Find the global maximum increment across all repositories in the component\n local global_max=0\n local num_repos\n num_repos=$(jq 'length' \u003c\u003c\u003c \"$all_repos_json\")\n for ((r = 0; r \u003c num_repos; r++)); do\n local repo\n repo=$(jq -r --argjson r \"$r\" '.[$r]' \u003c\u003c\u003c \"$all_repos_json\")\n local existing_tags\n existing_tags=$(skopeo list-tags --retry-times 3 docker://\"${repo}\" | jq -r '.Tags[]')\n local repo_max\n repo_max=$(echo \"${existing_tags}\" | { grep -E \"${tag_pattern}\" || true; } \\\n | sed -E \"s/^${escaped_prefix}//\" | sort -nr | head -n1)\n # Use 10# to force decimal input preventing leading 0 from being treated as octal\n if [[ -n \"$repo_max\" ]] \u0026\u0026 [[ $((10#${repo_max})) -gt $global_max ]]; then\n global_max=$((10#${repo_max}))\n fi\n done\n\n local increment=$((global_max + 1))\n\n # Cache the result so subsequent repos in this component reuse the same value\n echo \"${increment}\" \u003e \"${cache_file}\"\n\n local tag\n # shellcheck disable=SC2001\n tag=$(echo \"${tag_template}\" | sed \"s/{{ *component-incrementer *}}/${increment}/g\")\n\n if [[ ! \"${tag}\" =~ ^[a-zA-Z0-9._-]+$ ]]; then\n echo \"Error: Invalid tag format after substitution: ${tag}\" \u003e\u00262\n exit 1\n fi\n\n echo \"$tag\"\n}\n\n# Expected arguments are: [variable, substitute_map, labels_map]\nsubstitute() {\n variable=$1\n substitute_map=$2\n labels_map=$3\n\n result=\"\"\n if [[ \"$variable\" == labels.* ]]; then\n label=\"${variable#labels.}\"\n result=\"$(jq -r --arg labelval \"$label\" '.[$labelval] // \"\"' \u003c\u003c\u003c \"${labels_map}\")\"\n else\n result=\"$(jq -r --arg variable \"$variable\" '.[$variable] // \"\"' \u003c\u003c\u003c \"${substitute_map}\")\"\n fi\n echo \"$result\"\n}\n\n# When addImplicitTimestampTag is true, append the resolved timestamp value to the\n# translated tag list (and deduplicate). Fails if timestamp is empty. Only used by\n# the rh-advisories pipeline.\nensure_implicit_timestamp_value() {\n local tags_json=\"$1\"\n local timestamp_val=\"$2\"\n if [ \"false\" != \"true\" ]; then\n echo \"$tags_json\"\n return\n fi\n if [ -z \"$timestamp_val\" ]; then\n echo \"Error: addImplicitTimestampTag is true but timestamp is empty (no build-date or Created).\" \u003e\u00262\n exit 1\n fi\n echo \"$tags_json\" | jq -c --arg ts \"$timestamp_val\" '. + [$ts] | unique'\n}\n\n# Expected arguments are [tags, substitute_map, labels_map, repo, all_repos_json]\n# The tags argument is a json array\ntranslate_tags () {\n local tags=$1\n local substitute_map=$2\n local labels_map=$3\n local repo=$4\n local all_repos_json=\"${5:-[]}\"\n if [ \"$tags\" = '' ] ; then\n echo ''\n return\n fi\n\n local translated_tags='[]'\n local NUM_TAGS\n NUM_TAGS=\"$(jq 'length' \u003c\u003c\u003c \"${tags}\")\"\n local i tag var_name replacement\n for ((i = 0; i \u003c NUM_TAGS; i++)); do\n tag=\"$(jq -r --argjson i \"$i\" '.[$i]' \u003c\u003c\u003c \"${tags}\")\"\n\n # Repeatedly translate {{}} references until none are left\n while [[ $tag =~ \\{\\{\\ *([[:alnum:]_\\.-]+)\\ *\\}\\} ]]; do\n # Extract the variable name (e.g., timestamp), trimming any surrounding spaces\n var_name=\"${BASH_REMATCH[1]}\"\n\n # Sanity check of the template variable name\n if [[ ! \"$var_name\" =~ ^[a-zA-Z0-9._-]+$ ]]; then\n echo \"Error: Invalid variable name in tag definition: $var_name\" \u003e\u00262\n exit 1\n fi\n\n # Handle incrementer logic\n if [[ \"$var_name\" == \"incrementer\" ]]; then\n tag=$(increment_tag \"$tag\" \"$repo\")\n elif [[ \"$var_name\" == \"component-incrementer\" ]]; then\n tag=$(component_increment_tag \"$tag\" \"$all_repos_json\")\n else\n replacement=$(substitute \"$var_name\" \"$substitute_map\" \"$labels_map\")\n if [ -z \"$replacement\" ]; then\n echo Error: Substitution variable unknown or empty: \"$var_name\" \u003e\u00262\n exit 1\n fi\n # Shellcheck suggests ${var//find/replace}, but\n # that won't work here - we need to match arbitrary amount of spaces\n # shellcheck disable=SC2001\n tag=\"$(sed \"s/{{ *$var_name *}}/$replacement/\" \u003c\u003c\u003c \"$tag\")\"\n fi\n done\n\n # Sanity check of the resulting tag value\n if [[ ! \"$tag\" =~ ^[a-zA-Z0-9._-]+$ ]]; then\n echo \"Error: Invalid tag format: $tag\" \u003e\u00262\n exit 1\n fi\n\n # Avoid duplicate tags - only add a tag if not already present\n if [ \"$(jq -c --arg tag \"$tag\" 'index($tag)' \u003c\u003c\u003c \"$translated_tags\")\" = null ]\n then\n translated_tags=\"$(jq -c --arg tag \"$tag\" '. + [$tag]' \u003c\u003c\u003c \"$translated_tags\")\"\n fi\n done\n\n echo \"$translated_tags\"\n}\n\nconvert_to_quay () { # Convert the registry.redhat.io URL to the quay.io format\n local repository=$1\n case \"$repository\" in\n registry.redhat.io/*)\n echo \"${repository/registry.redhat.io/quay.io/redhat-prod}\" \\\n | sed 's|/|----|g; s|quay.io----redhat-prod----|quay.io/redhat-prod/|'\n ;;\n registry.stage.redhat.io/*)\n echo \"${repository/registry.stage.redhat.io/quay.io/redhat-pending}\" \\\n | sed 's|/|----|g; s|quay.io----redhat-pending----|quay.io/redhat-pending/|'\n ;;\n flatpaks.registry.redhat.io/*)\n echo \"${repository/flatpaks.registry.redhat.io/quay.io/rh-flatpaks-prod}\" \\\n | sed 's|/|----|g; s|quay.io----rh-flatpaks-prod----|quay.io/rh-flatpaks-prod/|'\n ;;\n flatpaks.registry.stage.redhat.io/*)\n echo \"${repository/flatpaks.registry.stage.redhat.io/quay.io/rh-flatpaks-stage}\" \\\n | sed 's|/|----|g; s|quay.io----rh-flatpaks-stage----|quay.io/rh-flatpaks-stage/|'\n ;;\n *)\n echo \"$repository\"\n ;;\n esac\n}\n\n# This block is temporary to support both quay.io and registry.redhat.io\n# It should be removed once all repositories are migrated to registry.redhat.io\nconvert_to_registry () { # Convert the repository URL to the registry.redhat.io format\n local repository=$1\n case \"$repository\" in\n quay.io/redhat-prod/*)\n repository=\"${repository//quay.io\\/redhat-prod/registry.redhat.io}\"\n repository=\"${repository//----//}\"\n echo \"$repository\"\n ;;\n quay.io/redhat-pending/*)\n repository=\"${repository//quay.io\\/redhat-pending/registry.stage.redhat.io}\"\n repository=\"${repository//----//}\"\n echo \"$repository\"\n ;;\n quay.io/rh-flatpaks-prod/*)\n repository=\"${repository//quay.io\\/rh-flatpaks-prod/flatpaks.registry.redhat.io}\"\n repository=\"${repository//----//}\"\n echo \"$repository\"\n ;;\n quay.io/rh-flatpaks-stage/*)\n repository=\"${repository//quay.io\\/rh-flatpaks-stage/flatpaks.registry.stage.redhat.io}\"\n repository=\"${repository//----//}\"\n echo \"$repository\"\n ;;\n registry.redhat.io/* | registry.stage.redhat.io/*)\n # Return the original Red Hat registry paths\n echo \"$repository\"\n ;;\n *)\n # Return empty for unhandled formats\n echo \"\"\n ;;\n esac\n}\n\nconvert_to_registry_access () { # Convert the repository URL to the registry.access.redhat.com format\n local repository=$1\n case \"$repository\" in\n registry.redhat.io/*)\n echo \"${repository/registry.redhat.io/registry.access.redhat.com}\"\n ;;\n registry.stage.redhat.io/*)\n echo \"${repository/registry.stage.redhat.io/registry.access.stage.redhat.com}\"\n ;;\n *)\n echo \"\"\n ;;\n esac\n}\n\n# Merge the mapping key contents in the data JSON file with the components key in the snapshot based\n# on component name. Save the output as a compact JSON in the mapped_snapshot.json file in the workspace\n{ echo -n \"$(cat \"${SNAPSHOT_SPEC_FILE_ORIG}\")\"; echo \"${MAPPING}\"; } | jq -c -s '\n .[0] as $snapshot | .[0].components + .[1].components | group_by(.name) |\n [.[] | select(length \u003e 1)] | map(reduce .[] as $x ({}; . * $x)) as $mergedComponents |\n $snapshot | .components = $mergedComponents' \u003e \"${SNAPSHOT_SPEC_FILE}\"\n\nprintf \"true\" | tee \"/tekton/results/mapped\"\n\nif [ \"true\" = \"true\" ] \u0026\u0026 \\\n [ \"$(jq '.components | length' \u003c \"${SNAPSHOT_SPEC_FILE}\")\" -eq 0 ]; then\n echo \"ERROR: Resulting snapshot contains 0 components. This means that there were 0 components present in\"\n echo \"both your Snapshot and your ReleasePlanAdmission mapping. Take a look at your component names and\"\n echo \"make sure that all components you want to release from the snapshot are present in the\"\n echo \"ReleasePlanAdmission (by the name field of the component).\"\n echo \"Components in snapshot: $(jq -c '[.components[].name]' \"${SNAPSHOT_SPEC_FILE_ORIG}\")\"\n echo \"Components in mapping: $(jq -c '[.components[].name]' \u003c\u003c\u003c \"${MAPPING}\")\"\n exit 1\nfi\n\n# Expand the tags in the data file\ndefaultTags=$(jq '.defaults.tags // []' \u003c\u003c\u003c \"$MAPPING\")\ndefaultTimestampFormat=$(jq -r '.defaults.timestampFormat // \"%s\"' \u003c\u003c\u003c \"$MAPPING\")\ncurrentTimestamp=\"$(date \"+%Y%m%d %T\")\"\ndefaultCGWSettings=$(jq -c '.defaults.contentGateway // {}' \u003c\u003c\u003c \"$MAPPING\")\nNUM_MAPPED_COMPONENTS=$(jq '.components | length' \"${SNAPSHOT_SPEC_FILE}\")\n\n# File-based cache dir for component-incrementer results. A file-based\n# approach is required because component_increment_tag is invoked inside\n# $(...) subshells (via translate_tags), so bash associative array writes\n# would be lost on subshell exit. Files persist across subshell boundaries.\n_inc_cache_dir=$(mktemp -d)\ntrap 'rm -rf \"${_inc_cache_dir}\"' EXIT\n\nfor ((i = 0; i \u003c NUM_MAPPED_COMPONENTS; i++)) ; do\n # Clear the cache at the start of each component so that different\n # components with the same tag template use independent repo sets.\n rm -f \"${_inc_cache_dir}/\"* 2\u003e/dev/null || true\n component=$(jq -c --argjson i \"$i\" '.components[$i]' \"${SNAPSHOT_SPEC_FILE}\")\n componentTags=$(jq '.componentTags // []' \u003c\u003c\u003c \"$component\")\n defaultComponentTags=$(jq -n --argjson defaults \"$defaultTags\" --argjson componentTags \\\n \"$componentTags\" '$defaults? + $componentTags? | unique')\n\n # images are required to use sha reference - check this\n NAME=$(jq -r '.name' \u003c\u003c\u003c \"$component\")\n IMAGE_REF=$(jq -r '.containerImage' \u003c\u003c\u003c \"$component\")\n if ! [[ \"$IMAGE_REF\" =~ ^.+@sha256:[0-9a-f]+$ ]] ; then\n echo \"Component ${NAME} contains an invalid containerImage value. sha reference is required: ${IMAGE_REF}\"\n exit 1\n fi\n\n git_sha=$(jq -r '.source.git.revision' \u003c\u003c\u003c \"$component\") # this sets the value to \"null\" if it doesn't exist\n build_sha=${IMAGE_REF##*:}\n passedTimestampFormat=$(jq -r --arg default \"$defaultTimestampFormat\" \\\n '.timestampFormat // $default' \u003c\u003c\u003c \"$component\")\n release_timestamp=\"$(date -d \"$currentTimestamp\" \"+$passedTimestampFormat\")\"\n arch_json=\"$(get-image-architectures \"${IMAGE_REF}\")\"\n # The build-date label and Created values are not the same per architecture, but we don't support separate\n # tags per arch. So, we just use the first digest listed.\n arch=\"$(jq -rs 'map(.platform.architecture) | .[0]' \u003c\u003c\u003c \"$arch_json\")\"\n os=\"$(jq -rs 'map(.platform.os) | .[0]' \u003c\u003c\u003c \"$arch_json\")\"\n\n # Get first digest from architecture info to construct image reference\n first_digest=\"$(jq -rs '.[0].digest' \u003c\u003c\u003c \"$arch_json\")\"\n\n # Construct image reference with the first architecture's digest for annotations\n image_with_digest=\"${IMAGE_REF%@*}@${first_digest}\"\n\n # Get raw manifest to extract annotations (works for all image types)\n raw_manifest=\"$(skopeo inspect --retry-times 3 --no-tags --raw docker://\"${image_with_digest}\" | jq -c)\"\n annotations=\"$(jq -c '.annotations // {}' \u003c\u003c\u003c \"$raw_manifest\")\"\n\n # Get config.mediaType from raw manifest to determine if this is a standard container image\n config_media_type=\"$(jq -r '.config.mediaType // \"\"' \u003c\u003c\u003c \"$raw_manifest\")\"\n\n # Get image metadata for labels, env, build_date\n # Only standard container images support skopeo inspect without --raw\n # Standard config types are:\n # - application/vnd.oci.image.config.v1+json (OCI images)\n # - application/vnd.docker.container.image.v1+json (Docker images)\n # All other artifacts (Helm charts, ML models, empty configs, etc.) don't have\n # labels/env and would fail with skopeo inspect\n if [[ \"$config_media_type\" == \"application/vnd.oci.image.config.v1+json\" ]] || \\\n [[ \"$config_media_type\" == \"application/vnd.docker.container.image.v1+json\" ]]; then\n # Standard container images - use standard skopeo inspect\n image_metadata=\"$(skopeo inspect --retry-times 3 --no-tags \\\n --override-os \"${os}\" --override-arch \"${arch}\" docker://\"${IMAGE_REF}\" | jq -c)\"\n # For timestamp, use Labels.build-date and fallback to Created\n build_date=\"$(jq -r '.Labels.\"build-date\" // .Created // \"\"' \u003c\u003c\u003c \"$image_metadata\")\"\n env_variables=\"$(jq -c '.Env // []' \u003c\u003c\u003c \"${image_metadata}\")\"\n labels=\"$(jq -c '.Labels // {}' \u003c\u003c\u003c \"${image_metadata}\")\"\n else\n # Non-standard artifacts (Helm charts, ML models, etc.) don't support\n # standard skopeo inspect - get build_date from annotations if available\n build_date=\"$(jq -r '.[\"org.opencontainers.image.created\"] // \"\"' \u003c\u003c\u003c \"$annotations\")\"\n env_variables=\"[]\"\n labels=\"{}\"\n fi\n\n # Get oci_version_raw from annotations, fallback to labels\n oci_version_raw=\"$(jq -r '.[\"org.opencontainers.image.version\"] // \"\"' \u003c\u003c\u003c \"$annotations\")\"\n if [ -z \"$oci_version_raw\" ]; then\n oci_version_raw=\"$(jq -r '.[\"org.opencontainers.image.version\"] // \"\"' \u003c\u003c\u003c \"$labels\")\"\n fi\n\n # Add image env_variables metadata to component\n if [ \"$(jq 'length' \u003c\u003c\u003c \"$env_variables\")\" -ne 0 ] ; then\n env_file=$(mktemp)\n echo \"$env_variables\" \u003e \"$env_file\"\n jq --argjson i \"$i\" --slurpfile env \"$env_file\" \\\n '.components[$i].metadata = (.components[$i].metadata // {}) * {env_variables: $env[0]}' \\\n \"${SNAPSHOT_SPEC_FILE}\" \u003e /tmp/temp \u0026\u0026 mv /tmp/temp \"${SNAPSHOT_SPEC_FILE}\"\n fi\n\n # Add image annotations metadata to component\n if [ \"$(jq 'length' \u003c\u003c\u003c \"$annotations\")\" -ne 0 ] ; then\n annotations_file=$(mktemp)\n # Convert annotations from {key: value} to [{name: key, value: value}]\n jq -c 'if . then to_entries | map({name: .key, value: .value}) else [] end' \\\n \u003c\u003c\u003c \"$annotations\" \u003e \"$annotations_file\"\n jq --argjson i \"$i\" --slurpfile annotations \"$annotations_file\" \\\n '.components[$i].metadata = (.components[$i].metadata // {}) * {annotations: $annotations[0]}' \\\n \"${SNAPSHOT_SPEC_FILE}\" \u003e /tmp/temp \u0026\u0026 mv /tmp/temp \"${SNAPSHOT_SPEC_FILE}\"\n fi\n\n # Add image labels metadata to component\n if [ \"$(jq 'length' \u003c\u003c\u003c \"$labels\")\" -ne 0 ] ; then\n labels_file=$(mktemp)\n # Convert labels from {key: value} to [{name: key, value: value}]\n jq -c 'if . then to_entries | map({name: .key, value: .value}) else [] end' \\\n \u003c\u003c\u003c \"$labels\" \u003e \"$labels_file\"\n jq --argjson i \"$i\" --slurpfile labels \"$labels_file\" \\\n '.components[$i].metadata = (.components[$i].metadata // {}) * {labels: $labels[0]}' \\\n \"${SNAPSHOT_SPEC_FILE}\" \u003e /tmp/temp \u0026\u0026 mv /tmp/temp \"${SNAPSHOT_SPEC_FILE}\"\n fi\n\n # Add media type to component\n if [ -n \"$config_media_type\" ]; then\n jq --argjson i \"$i\" --arg media_type \"$config_media_type\" \\\n '.components[$i].metadata = (.components[$i].metadata // {}) * {media_type: $media_type}' \\\n \"${SNAPSHOT_SPEC_FILE}\" \u003e /tmp/temp \u0026\u0026 mv /tmp/temp \"${SNAPSHOT_SPEC_FILE}\"\n fi\n\n # Transform version to OCI tag format: replace + with _ (convention for OCI compliance)\n # Set default value if empty (common for regular container images without OCI annotations)\n oci_version=\"${oci_version_raw//+/_}\"\n oci_version=\"${oci_version:-unknown}\"\n\n if [ \"${build_date}\" = \"\" ] ; then\n timestamp=\"\"\n else\n timestamp=\"$(date -d \"${build_date}\" \"+$passedTimestampFormat\")\"\n fi\n\n substitute_map=\"$(jq -n -c \\\n --arg timestamp \"${timestamp}\" \\\n --arg release_timestamp \"${release_timestamp}\" \\\n --arg git_sha \"${git_sha}\" \\\n --arg git_short_sha \"${git_sha:0:7}\" \\\n --arg digest_sha \"${build_sha}\" \\\n --arg oci_version \"${oci_version}\" \\\n '$ARGS.named')\"\n\n # Also substitute filename values in the staged section of components\n STAGED_FILES=$(jq '.staged.files | length' \u003c\u003c\u003c \"$component\")\n for ((j = 0; j \u003c STAGED_FILES; j++)) ; do\n file=$(jq -c --argjson j \"$j\" '.staged.files[$j]' \u003c\u003c\u003c \"$component\")\n filenameArrayPreSubstitution=$(jq '.filename' \u003c\u003c\u003c \"$file\" | jq -cs)\n # {{ incrementer }} is not supported in staged.files values, so we just pass\n # \"\" as the repo argument\n subbedFilename=$(translate_tags \"${filenameArrayPreSubstitution}\" \\\n \"${substitute_map}\" \"${labels}\" \"\"| jq -r '.[0]')\n jq --argjson i \"$i\" --argjson j \"$j\" --arg filename \"$subbedFilename\" \\\n '.components[$i].staged.files[$j].filename = $filename' \"${SNAPSHOT_SPEC_FILE}\" \u003e /tmp/temp \\\n \u0026\u0026 mv /tmp/temp \"${SNAPSHOT_SPEC_FILE}\"\n done\n\n # apply defaults for contentGateway\n componentCGWSettings=$(jq -c '.contentGateway // {}' \u003c\u003c\u003c \"$component\")\n updatedComponentCGWSettings=$(merge-json \"$defaultCGWSettings\" \"$componentCGWSettings\")\n componentCGWSettingsSize=$(jq '. | length' \u003c\u003c\u003c \"${updatedComponentCGWSettings}\")\n\n if [ \"${componentCGWSettingsSize}\" -gt \"0\" ]; then\n jq --argjson i \"$i\" --argjson componentCGWSettings \"$updatedComponentCGWSettings\" \\\n '.components[$i].contentGateway = $componentCGWSettings' \\\n \"${SNAPSHOT_SPEC_FILE}\" \u003e /tmp/temp \u0026\u0026 mv /tmp/temp \"${SNAPSHOT_SPEC_FILE}\"\n fi\n\n # Build a JSON array of all repository URLs for this component.\n # This is used by {{ component-incrementer }} to query all repos and compute a\n # uniform increment value across registries.\n component_repos_json='[]'\n _ci_num_repos=$(jq '.repositories | length' \u003c\u003c\u003c \"$component\")\n for ((_ci_j = 0; _ci_j \u003c _ci_num_repos; _ci_j++)) ; do\n _ci_repo_url=$(jq -r --argjson j \"$_ci_j\" '.repositories[$j].url' \u003c\u003c\u003c \"$component\")\n component_repos_json=$(jq -c --arg url \"$_ci_repo_url\" '. + [$url]' \\\n \u003c\u003c\u003c \"$component_repos_json\")\n done\n\n NUM_REPOSITORIES=$(jq '.repositories | length' \u003c\u003c\u003c \"$component\")\n for ((j = 0; j \u003c NUM_REPOSITORIES; j++)) ; do\n repository=$(jq -c --argjson j \"$j\" '.repositories[$j]' \u003c\u003c\u003c \"$component\")\n repoTags=$(jq '.tags // []' \u003c\u003c\u003c \"$repository\")\n url=$(jq -r '.url' \u003c\u003c\u003c \"$repository\")\n echo \"Processing component: $NAME, repository: $url\"\n\n allTagsPreSubstitution=$(jq -n --argjson defaults \"$defaultComponentTags\" --argjson repoTags \\\n \"$repoTags\" '$defaults? + $repoTags? | unique')\n tags=$(translate_tags \"${allTagsPreSubstitution}\" \"${substitute_map}\" \"${labels}\" \"${url}\" \\\n \"${component_repos_json}\")\n tags=$(ensure_implicit_timestamp_value \"${tags}\" \"${timestamp}\")\n if [ \"$(jq 'length' \u003c\u003c\u003c \"$tags\")\" -gt 0 ] ; then\n jq --argjson i \"$i\" --argjson j \"$j\" --argjson updatedTags \"$tags\" \\\n '.components[$i].repositories[$j].tags = $updatedTags' \"${SNAPSHOT_SPEC_FILE}\" \u003e /tmp/temp \\\n \u0026\u0026 mv /tmp/temp \"${SNAPSHOT_SPEC_FILE}\"\n fi\n\n # This block is temporary to support both quay.io and registry.redhat.io\n # It should be removed once all repositories are migrated to registry.redhat.io\n if [[ \"$url\" == quay.io/redhat-prod/* ||\n \"$url\" == quay.io/redhat-pending/* ||\n \"$url\" == quay.io/rh-flatpaks-prod/* ||\n \"$url\" == quay.io/rh-flatpaks-stage/* ]]; then\n url=$(convert_to_registry \"$url\")\n fi\n\n # Convert to registry and quay format\n if [[ \"$url\" == registry.redhat.io/* ||\n \"$url\" == registry.stage.redhat.io/* ||\n \"$url\" == flatpaks.registry.redhat.io/* ||\n \"$url\" == flatpaks.registry.stage.redhat.io/* ]]; then\n rh_registry_repo=$url\n registry_access_repo=$(convert_to_registry_access \"$url\")\n url=$(convert_to_quay \"$url\")\n\n jq --argjson i \"$i\" \\\n --argjson j \"$j\" \\\n --arg url \"$url\" \\\n --arg rh_registry_repo \"$rh_registry_repo\" \\\n --arg registry_access_repo \"$registry_access_repo\" \\\n '.components[$i].repositories[$j].url = $url |\n .components[$i].repositories[$j][\"rh-registry-repo\"] = $rh_registry_repo |\n .components[$i].repositories[$j][\"registry-access-repo\"] = $registry_access_repo' \\\n \"${SNAPSHOT_SPEC_FILE}\" \u003e /tmp/temp \u0026\u0026 mv /tmp/temp \"${SNAPSHOT_SPEC_FILE}\"\n fi\n done\ndone\n" }, { "args": [ "create", "--store", "quay-service.quay/test-org/trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/e23d1979-2dfb-4c87-88c3-15ac8108247e", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:21:11Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "check-data-keys", "tekton.dev/task": "check-data-keys" }, "name": "managed-w9dpl-check-data-keys", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "11486", "uid": "e23d1979-2dfb-4c87-88c3-15ac8108247e" }, "spec": { "params": [ { "name": "dataPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json" }, { "name": "schema", "value": "https://github.com/konflux-ci/release-service-catalog/raw/bd80323ebdcec16651470f96ed8ba226a13ca7bb/schema/dataKeys.json" }, { "name": "systems", "value": "[\n {\"systemName\": \"mapping\", \"dynamic\": false}\n]\n" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/check-data-keys/check-data-keys.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:21:26Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:21:26Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-check-data-keys-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/check-data-keys/check-data-keys.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "sourceDataArtifact", "type": "string", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:39c68d224821d3ced59a35bb88ca4cc7f5312d1be3613c410e07ccfaeaf81531" } ], "startTime": "2026-07-03T12:21:11Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://e0ef138bac0d7bae73c38f12192ea89998b2ba47f61fb8b3878a2b324d53c9ee", "exitCode": 0, "finishedAt": "2026-07-03T12:21:22Z", "reason": "Completed", "startedAt": "2026-07-03T12:21:21Z" }, "terminationReason": "Completed" }, { "container": "step-check-data-keys", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "check-data-keys", "provenance": {}, "terminated": { "containerID": "containerd://c6f59bf8b010e36c9ef27abe9c46aac7caa21aa49526d15875f995b29240daa8", "exitCode": 0, "finishedAt": "2026-07-03T12:21:24Z", "reason": "Completed", "startedAt": "2026-07-03T12:21:22Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://b330d86142acf569a41cc410b697a4a63c6e38ea25a51499a4ae4c88d4302dd2", "exitCode": 0, "finishedAt": "2026-07-03T12:21:25Z", "message": "[{\"key\":\"sourceDataArtifact\",\"value\":\"oci:quay-service.quay/test-org/trusted-artifacts@sha256:39c68d224821d3ced59a35bb88ca4cc7f5312d1be3613c410e07ccfaeaf81531\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:25Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task that validates data keys against a schema to ensure that all required keys for a system(s) are present\nand correctly formatted. The system(s) passed into the `systems` parameter become required.\nThe schema validation also applies to all data passed into the `dataPath` parameter,\nmeaning all the data keys must be allowed and formatted correctly.\n\nFor example, if `releaseNotes` is passed as a system and the data file does not have all the required\nreleaseNotes keys, the schema will give validation errors, and the task will fail.\n\nThe validation schema is defined in `schema/dataKeys.json` in this repository.", "params": [ { "description": "Path to the JSON string of the merged data to use", "name": "dataPath", "type": "string" }, { "default": "https://raw.githubusercontent.com/konflux-ci/release-service-catalog/refs/heads/development/schema/dataKeys.json", "description": "URL to the JSON schema file to validate the data against", "name": "schema", "type": "string" }, { "default": "", "description": "The systems to check that all data keys are present for", "name": "systems", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "Produced trusted data artifact", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "10m", "memory": "64Mi" } }, "env": [ { "name": "SCHEMA_FILE", "value": "https://github.com/konflux-ci/release-service-catalog/raw/bd80323ebdcec16651470f96ed8ba226a13ca7bb/schema/dataKeys.json" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "check-data-keys", "script": "#!/usr/bin/env bash\nset -ex\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\nif [ ! -f \"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\" ] ; then\n echo \"No data JSON was provided.\"\n exit 1\nfi\n\nschema=\"${SCHEMA_FILE/\\.git\\///}\"\nif ! curl -sL --fail-with-body --retry 3 --retry-delay 5 --retry-all-errors \"$schema\" -o /tmp/schema ; then\n echo \"Failed to download schema file: $schema\"\n exit 1\nfi\n\n# We want this to output the json without expansion\n# shellcheck disable=SC2016\njq --argjson systems '[\n {\"systemName\": \"mapping\", \"dynamic\": false}\n]\n' '.systems += $systems' \\\n \"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\" \u003e \"/tmp/systems\"\nmv \"/tmp/systems\" \"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\"\n\ncheck-jsonschema --output-format=text --schemafile \"/tmp/schema\" \"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\"\n" }, { "args": [ "create", "--store", "quay-service.quay/test-org/trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/403bdc0b-fd3d-42f0-91b4-8b092c9c72ac", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:20:20Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "collect-data", "tekton.dev/task": "collect-data" }, "name": "managed-w9dpl-collect-data", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "10974", "uid": "403bdc0b-fd3d-42f0-91b4-8b092c9c72ac" }, "spec": { "params": [ { "name": "release", "value": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7" }, { "name": "releasePlan", "value": "ex-registry-sh-ac62a10d/source-releaseplan" }, { "name": "releasePlanAdmission", "value": "ex-registry-sh-managed-ac62a10d/demo" }, { "name": "releaseServiceConfig", "value": "release-service/release-service-config" }, { "name": "snapshot", "value": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d" }, { "name": "subdirectory", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/collect-data/collect-data.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:21:11Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:21:11Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-collect-data-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/collect-data/collect-data.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "data", "type": "string", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json" }, { "name": "release", "type": "string", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release.json" }, { "name": "releasePipelineMetadata", "type": "string", "value": "{\"org\":\"konflux-ci\",\"repo\":\"release-service-catalog\",\"revision\":\"bd80323ebdcec16651470f96ed8ba226a13ca7bb\",\"pathinrepo\":\"pipelines/managed/push-to-external-registry/push-to-external-registry.yaml\",\"sha\":\"bd80323ebdcec16651470f96ed8ba226a13ca7bb\"}\n" }, { "name": "releasePlan", "type": "string", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan.json" }, { "name": "releasePlanAdmission", "type": "string", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan_admission.json" }, { "name": "releaseServiceConfig", "type": "string", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_service_config.json" }, { "name": "resultsDir", "type": "string", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/results" }, { "name": "singleComponentMode", "type": "string", "value": "false" }, { "name": "snapshotBuildId", "type": "string", "value": "" }, { "name": "snapshotName", "type": "string", "value": "snapshot-sample-ac62a10d" }, { "name": "snapshotNamespace", "type": "string", "value": "ex-registry-sh-ac62a10d" }, { "name": "snapshotSpec", "type": "string", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" }, { "name": "subdirectory", "type": "string", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" }, { "name": "sourceDataArtifact", "type": "string", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107" } ], "startTime": "2026-07-03T12:20:20Z", "steps": [ { "container": "step-collect-data", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "collect-data", "provenance": {}, "terminated": { "containerID": "containerd://58837aaa736ffaf5661e76a17754f99652a7beba6658694bb31dee8f9a68e129", "exitCode": 0, "finishedAt": "2026-07-03T12:21:09Z", "message": "[{\"key\":\"data\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\",\"type\":1},{\"key\":\"release\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release.json\",\"type\":1},{\"key\":\"releasePipelineMetadata\",\"value\":\"{\\\"org\\\":\\\"konflux-ci\\\",\\\"repo\\\":\\\"release-service-catalog\\\",\\\"revision\\\":\\\"bd80323ebdcec16651470f96ed8ba226a13ca7bb\\\",\\\"pathinrepo\\\":\\\"pipelines/managed/push-to-external-registry/push-to-external-registry.yaml\\\",\\\"sha\\\":\\\"bd80323ebdcec16651470f96ed8ba226a13ca7bb\\\"}\\n\",\"type\":1},{\"key\":\"releasePlan\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan.json\",\"type\":1},{\"key\":\"releasePlanAdmission\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan_admission.json\",\"type\":1},{\"key\":\"releaseServiceConfig\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_service_config.json\",\"type\":1},{\"key\":\"resultsDir\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/results\",\"type\":1},{\"key\":\"singleComponentMode\",\"value\":\"false\",\"type\":1},{\"key\":\"snapshotBuildId\",\"value\":\"\",\"type\":1},{\"key\":\"snapshotName\",\"value\":\"snapshot-sample-ac62a10d\",\"type\":1},{\"key\":\"snapshotNamespace\",\"value\":\"ex-registry-sh-ac62a10d\",\"type\":1},{\"key\":\"snapshotSpec\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json\",\"type\":1},{\"key\":\"subdirectory\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:07Z" }, "terminationReason": "Completed" }, { "container": "step-check-data-key-sources", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "check-data-key-sources", "provenance": {}, "terminated": { "containerID": "containerd://6b2df8dc344591c5ddb57e0cf813ea030686e8df063dfe4e21b5b8eb876d5acc", "exitCode": 0, "finishedAt": "2026-07-03T12:21:09Z", "message": "[{\"key\":\"data\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\",\"type\":1},{\"key\":\"release\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release.json\",\"type\":1},{\"key\":\"releasePipelineMetadata\",\"value\":\"{\\\"org\\\":\\\"konflux-ci\\\",\\\"repo\\\":\\\"release-service-catalog\\\",\\\"revision\\\":\\\"bd80323ebdcec16651470f96ed8ba226a13ca7bb\\\",\\\"pathinrepo\\\":\\\"pipelines/managed/push-to-external-registry/push-to-external-registry.yaml\\\",\\\"sha\\\":\\\"bd80323ebdcec16651470f96ed8ba226a13ca7bb\\\"}\\n\",\"type\":1},{\"key\":\"releasePlan\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan.json\",\"type\":1},{\"key\":\"releasePlanAdmission\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan_admission.json\",\"type\":1},{\"key\":\"releaseServiceConfig\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_service_config.json\",\"type\":1},{\"key\":\"resultsDir\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/results\",\"type\":1},{\"key\":\"singleComponentMode\",\"value\":\"false\",\"type\":1},{\"key\":\"snapshotBuildId\",\"value\":\"\",\"type\":1},{\"key\":\"snapshotName\",\"value\":\"snapshot-sample-ac62a10d\",\"type\":1},{\"key\":\"snapshotNamespace\",\"value\":\"ex-registry-sh-ac62a10d\",\"type\":1},{\"key\":\"snapshotSpec\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json\",\"type\":1},{\"key\":\"subdirectory\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:09Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://be61bd119bace41a3893c374bef86574e1a65b0501af6740fdf4f23a2c42e41a", "exitCode": 0, "finishedAt": "2026-07-03T12:21:10Z", "message": "[{\"key\":\"data\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\",\"type\":1},{\"key\":\"release\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release.json\",\"type\":1},{\"key\":\"releasePipelineMetadata\",\"value\":\"{\\\"org\\\":\\\"konflux-ci\\\",\\\"repo\\\":\\\"release-service-catalog\\\",\\\"revision\\\":\\\"bd80323ebdcec16651470f96ed8ba226a13ca7bb\\\",\\\"pathinrepo\\\":\\\"pipelines/managed/push-to-external-registry/push-to-external-registry.yaml\\\",\\\"sha\\\":\\\"bd80323ebdcec16651470f96ed8ba226a13ca7bb\\\"}\\n\",\"type\":1},{\"key\":\"releasePlan\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan.json\",\"type\":1},{\"key\":\"releasePlanAdmission\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan_admission.json\",\"type\":1},{\"key\":\"releaseServiceConfig\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_service_config.json\",\"type\":1},{\"key\":\"resultsDir\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/results\",\"type\":1},{\"key\":\"singleComponentMode\",\"value\":\"false\",\"type\":1},{\"key\":\"snapshotBuildId\",\"value\":\"\",\"type\":1},{\"key\":\"snapshotName\",\"value\":\"snapshot-sample-ac62a10d\",\"type\":1},{\"key\":\"snapshotNamespace\",\"value\":\"ex-registry-sh-ac62a10d\",\"type\":1},{\"key\":\"snapshotSpec\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json\",\"type\":1},{\"key\":\"sourceDataArtifact\",\"value\":\"oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107\",\"type\":1},{\"key\":\"subdirectory\",\"value\":\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:09Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task to collect the information added to the data field of the release resources.\n\nThe purpose of this task is to collect all the data and supply it to the other task in the pipeline by creating\na json file called `data.json` in the workspace.\n\nThis task also stores the passed resources as json files in a workspace.\n\nThe parameters to this task are lowercase instead of camelCase because they are passed from the operator, and the\noperator passes them as lowercase.\n\nA task result is returned for each resource with the relative path to the stored JSON for it in the workspace.\n\nFinally, the task checks that the keys from the correct resource (a key that should come from the\nReleasePlanAdmission should not be present in the Release data section).", "params": [ { "description": "The namespaced name of the Release", "name": "release", "type": "string" }, { "description": "The namespaced name of the ReleasePlan", "name": "releasePlan", "type": "string" }, { "description": "The namespaced name of the ReleasePlanAdmission", "name": "releasePlanAdmission", "type": "string" }, { "description": "The namespaced name of the ReleaseServiceConfig", "name": "releaseServiceConfig", "type": "string" }, { "description": "The namespaced name of the Snapshot", "name": "snapshot", "type": "string" }, { "default": "", "description": "Subdirectory inside the workspace to be used", "name": "subdirectory", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "The relative path in the workspace to the stored release json", "name": "release", "type": "string" }, { "description": "The relative path in the workspace to the stored releasePlan json", "name": "releasePlan", "type": "string" }, { "description": "The relative path in the workspace to the stored releasePlanAdmission json", "name": "releasePlanAdmission", "type": "string" }, { "description": "The relative path in the workspace to the stored releaseServiceConfig json", "name": "releaseServiceConfig", "type": "string" }, { "description": "The relative path in the workspace to the stored snapshotSpec json", "name": "snapshotSpec", "type": "string" }, { "description": "The relative path in the workspace to the stored data json", "name": "data", "type": "string" }, { "description": "The relative path in the workspace to the results directory", "name": "resultsDir", "type": "string" }, { "description": "single component mode", "name": "singleComponentMode", "type": "string" }, { "description": "name of Snapshot resource", "name": "snapshotName", "type": "string" }, { "description": "namespace where Snapshot is located", "name": "snapshotNamespace", "type": "string" }, { "description": "Build Id where Snapshot originated", "name": "snapshotBuildId", "type": "string" }, { "description": "json object containing git resolver metadata about the running release pipeline", "name": "releasePipelineMetadata", "type": "string" }, { "description": "Produced trusted data artifact", "name": "sourceDataArtifact", "type": "string" }, { "description": "Subdirectory inside the workspace to be used", "name": "subdirectory", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "50m", "memory": "64Mi" } }, "env": [ { "name": "RELEASE", "value": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7" }, { "name": "RELEASE_PLAN", "value": "ex-registry-sh-ac62a10d/source-releaseplan" }, { "name": "RELEASE_PLAN_ADMISSION", "value": "ex-registry-sh-managed-ac62a10d/demo" }, { "name": "RELEASE_SERVICE_CONFIG", "value": "release-service/release-service-config" }, { "name": "SNAPSHOT", "value": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "collect-data", "script": "#!/usr/bin/env bash\nset -eo pipefail\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\nset -x\necho -n \"8f02b3b8-8df6-4f92-88ef-58b2c26430d7\" \u003e \"/tekton/results/subdirectory\"\n\nRESULTS_DIR_PATH=\"results\"\nif [ -n \"8f02b3b8-8df6-4f92-88ef-58b2c26430d7\" ]; then\n mkdir -p \"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7\"\n RESULTS_DIR_PATH=\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/results\"\nfi\n\nmkdir -p \"/var/workdir/release/$RESULTS_DIR_PATH\"\necho -n \"$RESULTS_DIR_PATH\" \u003e \"/tekton/results/resultsDir\"\n\nRELEASE_PATH=\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release.json\"\necho -n \"$RELEASE_PATH\" \u003e \"/tekton/results/release\"\nget-resource \"release\" \"${RELEASE}\" | tee \"/var/workdir/release/$RELEASE_PATH\"\n\nRELEASEPLAN_PATH=\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan.json\"\necho -n \"$RELEASEPLAN_PATH\" \u003e \"/tekton/results/releasePlan\"\nget-resource \"releaseplan\" \"${RELEASE_PLAN}\" | tee \"/var/workdir/release/$RELEASEPLAN_PATH\"\n\nRELEASEPLANADMISSION_PATH=\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan_admission.json\"\necho -n \"$RELEASEPLANADMISSION_PATH\" \u003e \"/tekton/results/releasePlanAdmission\"\nget-resource \"releaseplanadmission\" \"${RELEASE_PLAN_ADMISSION}\" \\\n | tee \"/var/workdir/release/$RELEASEPLANADMISSION_PATH\"\n\nRELEASESERVICECONFIG_PATH=\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_service_config.json\"\necho -n \"$RELEASESERVICECONFIG_PATH\" \u003e \"/tekton/results/releaseServiceConfig\"\nget-resource \"releaseserviceconfig\" \"${RELEASE_SERVICE_CONFIG}\" \\\n | tee \"/var/workdir/release/$RELEASESERVICECONFIG_PATH\"\n\necho -e \"\\nFetching Snapshot Spec\"\nSNAPSHOTSPEC_PATH=\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json\"\necho -n \"$SNAPSHOTSPEC_PATH\" \u003e \"/tekton/results/snapshotSpec\"\n# Empty-string componentGroup is treated as unset; fall back to .application, then drop it.\nget-resource \"snapshot\" \"${SNAPSHOT}\" \"{.spec}\" \\\n | jq '(if (.componentGroup == null or .componentGroup == \"\")\n then .componentGroup = .application else . end)\n | del(.application)' \\\n | tee \"/var/workdir/release/$SNAPSHOTSPEC_PATH\"\nlabels=$(get-resource \"snapshot\" \"${SNAPSHOT}\" \"{.metadata.labels}\")\nBUILD_ID=$(jq -r '.\"appstudio.openshift.io/build-pipelinerun\" // \"\"' \u003c\u003c\u003c \"${labels}\")\necho -n \"${BUILD_ID}\" | tee \"/tekton/results/snapshotBuildId\"\n\necho -e \"\\nGenerating collectors data\"\ncollectors_status=$(get-resource \"release\" \"${RELEASE}\" \"{.status.collectors}\")\necho \"***collectors status\"\necho \"${collectors_status}\"\necho \"***\"\n\ncollectors_result=$(jq -c '\n def deepmerge(a; b):\n reduce b[] as $item (a;\n reduce ($item | keys_unsorted[]) as $key (.;\n $item[$key] as $val | ($val | type) as $type | .[$key] = if ($type == \"object\") then\n deepmerge({}; [if .[$key] == null then {} else .[$key] end, $val])\n elif ($type == \"array\") then\n (.[$key] + $val | unique)\n else\n $val\n end)\n );\n\n # Ensure we safely handle missing collectors\n (.? // {}) as $collectors |\n\n # Flatten and combine the managed and tenant sections\n [($collectors.managed? // {} | to_entries | map(.value)) +\n ($collectors.tenant? // {} | to_entries | map(.value))] |\n flatten |\n deepmerge({}; .)\n' \u003c\u003c\u003c \"${collectors_status}\")\necho \"***collectors\"\njq \u003c\u003c\u003c \"$collectors_result\"\necho \"***\"\n\necho -e \"\\nFetching merged data json\"\nrelease_result=$(get-resource \"release\" \"${RELEASE}\" \"{.spec.data}\")\n\nrelease_plan_result=$(get-resource \"releaseplan\" \"${RELEASE_PLAN}\" \"{.spec.data}\")\n\nrelease_plan_admission_result=$(get-resource \"releaseplanadmission\" \"${RELEASE_PLAN_ADMISSION}\" \\\n \"{.spec.data}\")\n\n# Merge collectors and Release keys. Release has higher priority\nmerged_output=$(merge-json \"$collectors_result\" \"$release_result\")\n\n# Merge now with ReleasePlan keys. ReleasePlan has higher priority\nmerged_output=$(merge-json \"$merged_output\" \"$release_plan_result\")\n\n# Finally merge with ReleasePlanAdmission keys. ReleasePlanAdmission has higher priority\nmerged_output=$(merge-json \"$merged_output\" \"$release_plan_admission_result\")\n\nDATA_PATH=\"8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\"\necho -n \"$DATA_PATH\" \u003e \"/tekton/results/data\"\necho \"$merged_output\" | tee \"/var/workdir/release/$DATA_PATH\"\n\n# get pipeline ref info\npipelineref=$(jq -c '.spec.pipeline.pipelineRef' \\\n \"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan_admission.json\")\nresolver=$(jq -r '.resolver // \"\"' \u003c\u003c\u003c \"${pipelineref}\")\nif [ \"${resolver}\" == \"git\" ] ; then\n url=$(jq -r '.params[] | select(.name==\"url\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n revision=$(jq -r '.params[] | select(.name==\"revision\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n pathinrepo=$(jq -r '.params[] | select(.name==\"pathInRepo\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n orgrepo=\"${url#*/*/*/}\"\n org=$(echo \"${orgrepo}\" | cut -f1 -d/)\n repo=$(echo \"${orgrepo}\" | cut -f2 -d/ | cut -d. -f1)\n\n sha=$(curl -s \"https://api.github.com/repos/${org}/${repo}/commits/${revision}\" | jq -r '.sha // \"\"')\n\nfi\n\norg=\"${org:-unknown}\"\nrepo=\"${repo:-unknown}\"\nrevision=\"${revision:-unknown}\"\npathinrepo=\"${pathinrepo:-unknown}\"\nsha=\"${sha:-unknown}\"\n\necho \"\"\necho \"Release Pipeline Ref Info:\"\necho \"--------------------------\"\n\njson=$(jq -n -c \\\n --arg org \"${org}\" \\\n --arg repo \"${repo}\" \\\n --arg revision \"${revision}\" \\\n --arg pathinrepo \"${pathinrepo}\" \\\n --arg sha \"${sha}\" \\\n '$ARGS.named')\n\necho \"${json}\" \u003e \"/tekton/results/releasePipelineMetadata\"\n# pretty print for log message\njq . \u003c\u003c\u003c \"$json\"\n\nSINGLE_COMPONENT_MODE=$(jq -r '.singleComponentMode // \"false\"' \"/var/workdir/release/$DATA_PATH\")\nSNAPSHOT_NAME=$(echo \"${SNAPSHOT}\" | cut -f2 -d/)\nSNAPSHOT_NAMESPACE=$(echo \"${SNAPSHOT}\" | cut -f1 -d/)\n\necho -n \"${SINGLE_COMPONENT_MODE}\" | tee \"/tekton/results/singleComponentMode\"\necho -n \"${SNAPSHOT_NAME}\" | tee \"/tekton/results/snapshotName\"\necho -n \"${SNAPSHOT_NAMESPACE}\" | tee \"/tekton/results/snapshotNamespace\"\n" }, { "computeResources": { "limits": { "memory": "32Mi" }, "requests": { "cpu": "10m", "memory": "32Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "check-data-key-sources", "script": "#!/usr/bin/env bash\nset -ex\n\nDISALLOWED_KEYS_JSON='{\n \"Release\": [\n \"releaseNotes.product_id\",\n \"releaseNotes.product_name\",\n \"releaseNotes.product_version\",\n \"releaseNotes.product_stream\",\n \"releaseNotes.cpe\",\n \"releaseNotes.allow_custom_live_id\"\n ],\n \"ReleasePlan\": [\n \"releaseNotes.product_id\",\n \"releaseNotes.product_name\",\n \"releaseNotes.product_version\",\n \"releaseNotes.product_stream\",\n \"releaseNotes.cpe\",\n \"releaseNotes.allow_custom_live_id\"\n ],\n \"ReleasePlanAdmission\": [\n ]\n}'\n\nRC=0\n\ncheck_source () { # Expected arguments are [CRD from DISALLOWED_KEYS_JSON, file]\n for KEY in $(jq -r \".$1[]\" \u003c\u003c\u003c \"$DISALLOWED_KEYS_JSON\") ; do\n if [[ $(jq \".spec.data.$KEY\" \"$2\") != \"null\" ]] ; then\n echo \"Found disallowed key: $KEY in resource $1\"\n RC=1\n fi\n done\n}\n\ncheck_source \"Release\" \"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release.json\"\ncheck_source \"ReleasePlan\" \"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan.json\"\ncheck_source \"ReleasePlanAdmission\" \\\n \"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/release_plan_admission.json\"\n\nexit $RC\n" }, { "args": [ "create", "--store", "quay-service.quay/test-org/trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/a6eb72d4-7a16-4661-aa16-dc76446efc6f", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:21:11Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "collect-registry-token-secret", "tekton.dev/task": "collect-registry-token-secret" }, "name": "managed-w9dpl-collect-registry-token-secret", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "11444", "uid": "a6eb72d4-7a16-4661-aa16-dc76446efc6f" }, "spec": { "params": [ { "name": "dataPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/collect-registry-token-secret/collect-registry-token-secret.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:21:22Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:21:22Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-collect-registry-token-secret-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/collect-registry-token-secret/collect-registry-token-secret.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "registrySecret", "type": "string", "value": "quay-api-token" } ], "startTime": "2026-07-03T12:21:13Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://e16e4bf3d858461a7deb3f0a06d53464c4ad6638a63e84e05377fc90af018708", "exitCode": 0, "finishedAt": "2026-07-03T12:21:21Z", "reason": "Completed", "startedAt": "2026-07-03T12:21:20Z" }, "terminationReason": "Completed" }, { "container": "step-collect-secret", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-secret", "provenance": {}, "terminated": { "containerID": "containerd://5e22ea08bc9701717747029f473e8ffaa914166918a5647433cb4d61dde47f1b", "exitCode": 0, "finishedAt": "2026-07-03T12:21:22Z", "message": "[{\"key\":\"registrySecret\",\"value\":\"quay-api-token\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:22Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task that collects secret name containing registry token from the data file", "params": [ { "description": "Path to the merged data JSON file generated by collect-data task", "name": "dataPath", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "The kube secret to use quay.io API, containing one key: token", "name": "registrySecret", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "50m", "memory": "128Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-secret", "script": "#!/usr/bin/env bash\nset -eux\n\nDATA_FILE=\"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\"\nif [ ! -f \"${DATA_FILE}\" ] ; then\n echo \"No valid data file was provided.\"\n exit 1\nfi\n\n# Check if there is anything to make public - either in defaults, or a component\nSECRET_REQUIRED=false\nif [ \"$(jq -r '.mapping.defaults.public // false' \"$DATA_FILE\")\" = true ] ; then\n SECRET_REQUIRED=true\nelse\n NUM_COMPONENTS=$(jq '.mapping.components | length' \"$DATA_FILE\")\n for ((i=0; i \u003c NUM_COMPONENTS; i++)); do\n COMPONENT=$(jq -c \".mapping.components[$i]\" \"$DATA_FILE\")\n if [ \"$(jq -r '.public // false' \u003c\u003c\u003c \"$COMPONENT\")\" = true ] ; then\n SECRET_REQUIRED=true\n break\n fi\n done\nfi\n\nif [ \"$SECRET_REQUIRED\" = false ]; then\n echo No repos to make public, so no secret is required. Exiting...\n echo -n \"\" \u003e \"/tekton/results/registrySecret\"\n exit 0\nfi\n\nif [ \"$(jq '.mapping | has(\"registrySecret\")' \"$DATA_FILE\")\" == false ] ; then\n echo \"Registry secret missing in data JSON file\"\n exit 1\nfi\n\njq -j '.mapping.registrySecret' \"$DATA_FILE\" | tee \"/tekton/results/registrySecret\"\n" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/7d3ed8e1-a617-437b-81f4-c89986fb1a2b", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:21:11Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "collect-signing-params", "tekton.dev/task": "collect-signing-params" }, "name": "managed-w9dpl-collect-signing-params", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "11759", "uid": "7d3ed8e1-a617-437b-81f4-c89986fb1a2b" }, "spec": { "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/collect-signing-params/collect-signing-params.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:21:46Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:21:46Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-collect-signing-params-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/collect-signing-params/collect-signing-params.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "buildIdentityRegexp", "type": "string", "value": "" }, { "name": "defaultOIDCIssuer", "type": "string", "value": "" }, { "name": "enableKeylessSigning", "type": "string", "value": "false" }, { "name": "fulcioExternalUrl", "type": "string", "value": "" }, { "name": "fulcioUrl", "type": "string", "value": "" }, { "name": "rekorExternalUrl", "type": "string", "value": "" }, { "name": "rekorUrl", "type": "string", "value": "" }, { "name": "tektonChainsIdentity", "type": "string", "value": "" }, { "name": "tufExternalUrl", "type": "string", "value": "" }, { "name": "tufUrl", "type": "string", "value": "" } ], "startTime": "2026-07-03T12:21:11Z", "steps": [ { "container": "step-collect-signing-params", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-signing-params", "provenance": {}, "terminated": { "containerID": "containerd://c4a09a40a5bd0ea7035f32a175b8096a2ad7768f477003bd52fd3ee395d149a5", "exitCode": 0, "finishedAt": "2026-07-03T12:21:45Z", "message": "[{\"key\":\"buildIdentityRegexp\",\"value\":\"\",\"type\":1},{\"key\":\"defaultOIDCIssuer\",\"value\":\"\",\"type\":1},{\"key\":\"enableKeylessSigning\",\"value\":\"false\",\"type\":1},{\"key\":\"fulcioExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"fulcioUrl\",\"value\":\"\",\"type\":1},{\"key\":\"rekorExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"rekorUrl\",\"value\":\"\",\"type\":1},{\"key\":\"tektonChainsIdentity\",\"value\":\"\",\"type\":1},{\"key\":\"tufExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"tufUrl\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:17Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task to collect Konflux configuration parameters related to\nkeyless signing using cosign. The task attempts to read the \"cluster-config\"\nConfigMap in the \"konflux-info\" namespace to extract signing parameters.\n\nIn case the ConfigMap is not found, the task will output empty strings for all parameters,\nallowing the pipeline to continue without signing parameters.", "params": [ { "default": "cluster-config", "description": "The name of the ConfigMap to read signing parameters from", "name": "configMapName", "type": "string" }, { "default": "konflux-info", "description": "The namespace where the ConfigMap is located", "name": "configMapNamespace", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "A flag indicating whether keyless signing should be enabled, based on the presence of signing parameters.\n", "name": "enableKeylessSigning", "type": "string" }, { "description": "A default OIDC issuer URL to be used for signing.\n", "name": "defaultOIDCIssuer", "type": "string" }, { "description": "The external URL of the Rekor transparency log.\n", "name": "rekorExternalUrl", "type": "string" }, { "description": "The internal URL of the Rekor transparency log.\n", "name": "rekorUrl", "type": "string" }, { "description": "The external URL of the Fulcio certificate authority.\n", "name": "fulcioExternalUrl", "type": "string" }, { "description": "The URL of the Fulcio certificate authority.\n", "name": "fulcioUrl", "type": "string" }, { "description": "The external URL of the TUF repository.\n", "name": "tufExternalUrl", "type": "string" }, { "description": "The URL of the TUF repository.\n", "name": "tufUrl", "type": "string" }, { "description": "A regular expression to extract build identity from the OIDC token claims, if applicable.\n", "name": "buildIdentityRegexp", "type": "string" }, { "description": "The identity used in the certificate, generated by fulcio.\n", "name": "tektonChainsIdentity", "type": "string" } ], "stepTemplate": { "computeResources": {}, "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "50m", "memory": "128Mi" }, "requests": { "cpu": "50m", "memory": "128Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-signing-params", "script": "#!/usr/bin/env bash\necho \"Getting cluster-config ConfigMap\"\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\n\n# Attempt to fetch the ConfigMap with retries, capture exit code\nif retry 3 kubectl get configmap \"cluster-config\" -n \"konflux-info\" -o json \u003e \\\n\"$KFLX_CONFIG_PATH\" 2\u003e/dev/null; then\n echo \"ConfigMap found, extracting signing parameters\"\n\n # Extract signing parameters from ConfigMap data, defaulting to empty string if not found\n enableKeylessSigning=$(jq -r '.data.enableKeylessSigning // \"\"' \"$KFLX_CONFIG_PATH\")\n defaultOIDCIssuer=$(jq -r '.data.defaultOIDCIssuer // \"\"' \"$KFLX_CONFIG_PATH\")\n rekorExternalUrl=$(jq -r '.data.rekorExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n rekorInternalUrl=$(jq -r '.data.rekorInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n fulcioExternalUrl=$(jq -r '.data.fulcioExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n fulcioInternalUrl=$(jq -r '.data.fulcioInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n tufExternalUrl=$(jq -r '.data.tufExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n tufInternalUrl=$(jq -r '.data.tufInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n buildIdentityRegexp=$(jq -r '.data.buildIdentityRegexp // \"\"' \"$KFLX_CONFIG_PATH\")\n tektonChainsIdentity=$(jq -r '.data.tektonChainsIdentity // \"\"' \"$KFLX_CONFIG_PATH\")\nelse\n echo \"ConfigMap not found, using default empty values\"\n\n # Set all parameters to empty strings when ConfigMap doesn't exist\n enableKeylessSigning=\"false\"\n defaultOIDCIssuer=\"\"\n rekorExternalUrl=\"\"\n rekorInternalUrl=\"\"\n fulcioExternalUrl=\"\"\n fulcioInternalUrl=\"\"\n tufExternalUrl=\"\"\n tufInternalUrl=\"\"\n buildIdentityRegexp=\"\"\n tektonChainsIdentity=\"\"\nfi\n\n# Write the values to the respective result paths and print them\necho -n \"$enableKeylessSigning\" | tee \"/tekton/results/enableKeylessSigning\"\necho -n \"$defaultOIDCIssuer\" | tee \"/tekton/results/defaultOIDCIssuer\"\necho -n \"$rekorExternalUrl\" | tee \"/tekton/results/rekorExternalUrl\"\nprefer_internal_or_external() {\n local internal=\"$1\"\n local external=\"$2\"\n local result_path=\"$3\"\n\n if [ -n \"$internal\" ]; then\n echo -n \"$internal\" | tee \"$result_path\"\n else\n echo -n \"$external\" | tee \"$result_path\"\n fi\n}\n\nprefer_internal_or_external \"$rekorInternalUrl\" \"$rekorExternalUrl\" \"/tekton/results/rekorUrl\"\necho -n \"$fulcioExternalUrl\" | tee \"/tekton/results/fulcioExternalUrl\"\nprefer_internal_or_external \"$fulcioInternalUrl\" \"$fulcioExternalUrl\" \"/tekton/results/fulcioUrl\"\necho -n \"$tufExternalUrl\" | tee \"/tekton/results/tufExternalUrl\"\nprefer_internal_or_external \"$tufInternalUrl\" \"$tufExternalUrl\" \"/tekton/results/tufUrl\"\necho -n \"$buildIdentityRegexp\" | tee \"/tekton/results/buildIdentityRegexp\"\necho -n \"$tektonChainsIdentity\" | tee \"/tekton/results/tektonChainsIdentity\"\n" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/60d2ced8-60b7-43d9-a0d2-870e508a9ebd", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:21:11Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "collect-task-params" }, "name": "managed-w9dpl-collect-task-params", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "11483", "uid": "60d2ced8-60b7-43d9-a0d2-870e508a9ebd" }, "spec": { "params": [ { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "dataPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json" }, { "name": "keysToExtract", "value": "[\n {\"resultIndex\": 0, \"key\": \".conforma.workerCount\", \"default\": \"4\"},\n {\"resultIndex\": 1, \"key\": \".sign.cosignSecretName\", \"default\": \"secret-not-present\"}\n]\n" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107" }, { "name": "trustedArtifactsDebug", "value": "" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/collect-task-params/collect-task-params.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:21:23Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:21:23Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-collect-task-params-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/collect-task-params/collect-task-params.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "extractedValues", "type": "array", "value": [ "4", "secret-not-present" ] } ], "startTime": "2026-07-03T12:21:11Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://d5b4c8d6607e1b79699f0b2bef9461789b2ebe74880dfc736b951087eed61f8d", "exitCode": 0, "finishedAt": "2026-07-03T12:21:22Z", "reason": "Completed", "startedAt": "2026-07-03T12:21:21Z" }, "terminationReason": "Completed" }, { "container": "step-collect-task-params", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-task-params", "provenance": {}, "terminated": { "containerID": "containerd://ccd7472428db1049ae3417590b42861efea74398b519854bf918421545afcfdc", "exitCode": 0, "finishedAt": "2026-07-03T12:21:23Z", "message": "[{\"key\":\"extractedValues\",\"value\":\"[\\n \\\"4\\\",\\n \\\"secret-not-present\\\"\\n]\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:23Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task that extracts values from the data JSON file based on specified keys and exposes them as task results.\nThe task takes an array of resultIndex/key pairs and extracts the corresponding values from the dataPath JSON file.\nEach extracted value is placed at the specified resultIndex in the extractedValues array for use by downstream\ntasks. Optional default values can be provided for keys that may not exist in the data file. If no default is\nprovided and the key does not exist, the task will fail.", "params": [ { "description": "Path to the JSON string of the merged data containing the values to extract", "name": "dataPath", "type": "string" }, { "description": "JSON array of objects with \"resultIndex\", \"key\", and optional \"default\" fields. Each object specifies the array\nindex where the extracted value should be placed, the JSON path key to extract from the data file, and an\noptional default value to use if the key is not found. Example: [{\"resultIndex\": 1,\n\"key\": \".releaseNotes.summary\"}, {\"resultIndex\": 0, \"key\": \".foo\", \"default\": \"fallback_value\"}]\n", "name": "keysToExtract", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "Array of extracted values. Each value is placed at the resultIndex specified in the keysToExtract parameter.\nValues can be accessed by their specified index in downstream tasks.\n", "name": "extractedValues", "type": "array" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "50m", "memory": "128Mi" } }, "env": [ { "name": "KEYS_JSON", "value": "[\n {\"resultIndex\": 0, \"key\": \".conforma.workerCount\", \"default\": \"4\"},\n {\"resultIndex\": 1, \"key\": \".sign.cosignSecretName\", \"default\": \"secret-not-present\"}\n]\n" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-task-params", "script": "#!/usr/bin/env bash\nset -x\n\nDATA_FILE=\"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\"\nif [ ! -f \"${DATA_FILE}\" ] ; then\n echo \"No valid data file was provided.\"\n exit 1\nfi\n\n# Validate KEYS_JSON format\nif ! jq -e 'type == \"array\"' \u003c\u003c\u003c \"$KEYS_JSON\" \u003e /dev/null; then\n echo \"keysToExtract must be a valid JSON array\"\n echo \"Received value: $KEYS_JSON\"\n exit 1\nfi\n\n# Get the number of keys to extract\nKEY_COUNT=$(jq 'length' \u003c\u003c\u003c \"$KEYS_JSON\")\nif [ \"$KEY_COUNT\" -eq 0 ]; then\n echo \"keysToExtract array is empty\"\n exit 1\nfi\n\n# Initialize result array with empty strings since it may not be populated in order based on\n# keysToExtract resultIndex input\nRESULT_ARRAY=\"[]\"\nfor i in $(seq 0 $((KEY_COUNT - 1))); do\n RESULT_ARRAY=$(jq '. += [\"\"]' \u003c\u003c\u003c \"$RESULT_ARRAY\")\ndone\n\nfor i in $(seq 0 $((KEY_COUNT - 1))); do\n RESULT_INDEX=$(jq -r \".[$i].resultIndex\" \u003c\u003c\u003c \"$KEYS_JSON\")\n KEY=$(jq -r \".[$i].key\" \u003c\u003c\u003c \"$KEYS_JSON\")\n DEFAULT_VALUE=$(jq -r \".[$i].default // null\" \u003c\u003c\u003c \"$KEYS_JSON\")\n\n if [ \"$RESULT_INDEX\" = \"null\" ] || [ \"$KEY\" = \"null\" ]; then\n echo \"Invalid key extraction specification at index $i: missing resultIndex or key\"\n exit 1\n fi\n\n # Check if resultIndex is a valid integer\n if ! [[ \"$RESULT_INDEX\" =~ ^[0-9]+$ ]]; then\n echo \"Error: resultIndex at position $i must be a non-negative integer, got: $RESULT_INDEX\"\n exit 1\n fi\n\n # Check if resultIndex is within valid bounds\n if [ \"$RESULT_INDEX\" -ge \"$KEY_COUNT\" ]; then\n echo \"Error: resultIndex $RESULT_INDEX at position $i is out of bounds.\"\n echo \"Valid range is 0 to $((KEY_COUNT - 1))\"\n exit 1\n fi\n\n # Extract the value from the data file using the specified key\n TRANSFORMED_KEY=$(echo \"$KEY\" | sed -E 's/\\.([^\\.\"\\[]+|\"[^\"]+\")/.\"\\1\"/g')\n VALUE=$(jq -r \"$TRANSFORMED_KEY\" \"$DATA_FILE\" 2\u003e/dev/null)\n\n # Check if the key exists in the data file\n if [ \"$VALUE\" = \"null\" ]; then\n if [ \"$DEFAULT_VALUE\" != \"null\" ]; then\n echo \"Key $KEY not found in data file, using default value: $DEFAULT_VALUE\"\n VALUE=\"$DEFAULT_VALUE\"\n else\n echo \"Error: Key $KEY not found in data file, and no default value for it was passed\"\n exit 1\n fi\n fi\n\n # Update the array at the specified resultIndex\n RESULT_ARRAY=$(jq --argjson idx \"$RESULT_INDEX\" --arg value \"$VALUE\" '.[$idx] = $value' \u003c\u003c\u003c \"$RESULT_ARRAY\")\ndone\n\n# Write the array result\njq \u003c\u003c\u003c \"$RESULT_ARRAY\" | tee \"/tekton/results/extractedValues\"\n" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/7fe45466-58e5-409c-9cb1-079922e8c2ee", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:21:56Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "collect-tpa-params", "tekton.dev/task": "collect-tpa-params" }, "name": "managed-w9dpl-collect-tpa-params", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "12184", "uid": "7fe45466-58e5-409c-9cb1-079922e8c2ee" }, "spec": { "params": [ { "name": "dataPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "failOnMissing", "value": "false" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/collect-tpa-params/collect-tpa-params.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:22:18Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:22:18Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-collect-tpa-params-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/collect-tpa-params/collect-tpa-params.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "atlasApiUrl", "type": "string", "value": "" }, { "name": "retryAWSSecretName", "type": "string", "value": "" }, { "name": "retryS3Bucket", "type": "string", "value": "" }, { "name": "secretName", "type": "string", "value": "" }, { "name": "ssoTokenUrl", "type": "string", "value": "" } ], "startTime": "2026-07-03T12:21:56Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://1298d8b4b99f49d8b290cefb32748a1fd0574521b1193ce7232d70ce75627408", "exitCode": 0, "finishedAt": "2026-07-03T12:22:02Z", "reason": "Completed", "startedAt": "2026-07-03T12:22:01Z" }, "terminationReason": "Completed" }, { "container": "step-collect-tpa-params", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-tpa-params", "provenance": {}, "terminated": { "containerID": "containerd://9a93fc25fdb19d69b33130c286e69420783388f0a8d39f51b019e62b7ffe7b7f", "exitCode": 0, "finishedAt": "2026-07-03T12:22:18Z", "message": "[{\"key\":\"atlasApiUrl\",\"value\":\"\",\"type\":1},{\"key\":\"retryAWSSecretName\",\"value\":\"\",\"type\":1},{\"key\":\"retryS3Bucket\",\"value\":\"\",\"type\":1},{\"key\":\"secretName\",\"value\":\"\",\"type\":1},{\"key\":\"ssoTokenUrl\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:22:03Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task that collects the TPA server option from the data file.\nIt can either parse the cluster configuration stored in konflux-info\nnamespace or parse a dataPath JSON file for values.\n\nIf the desired configmap is present in konflux-info, it will be used\nas a preferred option.\n\nOtherwise it outputs values based on the value of the \"atlas.server\" or\n\"tpa.servers\" field (\"stage\" or \"production\"), the output values are used\nto push SBOMs to TPA. Also outputs results used to push SBOMs to an S3\nbucket.\n\nIf the configmap in konflux-info cannot be parsed and no TPA fields\nare present in the data file, the task fails. If this is undesired,\nthe task can be configured to return empty results instead by setting\nthe parameter 'failOnMissing' to 'false'.", "params": [ { "default": "", "description": "Path to the JSON string of the merged data containing the TPA config\n", "name": "dataPath", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "konflux-info", "description": "The namespace where the ConfigMap is located", "name": "configMapNamespace", "type": "string" }, { "default": "cluster-config", "description": "The name of the ConfigMap to read TPA parameters from", "name": "configMapName", "type": "string" }, { "default": "true", "description": "Specify if this task should fail on missing parameters", "name": "failOnMissing", "type": "string" } ], "results": [ { "description": "URL of the TPA API.\n", "name": "atlasApiUrl", "type": "string" }, { "description": "URL of the SSO token issuer.\n", "name": "ssoTokenUrl", "type": "string" }, { "description": "The kubernetes secret to use to authenticate to TPA.\n", "name": "secretName", "type": "string" }, { "description": "The kubernetes secret to use to authenticate to the S3 retry mechanism bucket.\n", "name": "retryAWSSecretName", "type": "string" }, { "description": "Name of the S3 retry mechanism bucket.\n", "name": "retryS3Bucket", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "50m", "memory": "128Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-tpa-params", "script": "#!/usr/bin/env bash\nset -x\n\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\n\necho 'Checking for configuration...'\nif retry 3 kubectl get configmap \"cluster-config\" -n \"konflux-info\" -o json \u003e \\\n \"$KFLX_CONFIG_PATH\"; then\n atlasApiURL=$(jq -r '.data.trustifyServerExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n ssoTokenBaseURL=$(jq -r '.data.trustifyOIDCIssuerUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n if [ -n \"$atlasApiURL\" ] \u0026\u0026 [ -n \"$ssoTokenBaseURL\" ]; then\n echo 'Detected cluster-config, gathering information...'\n ssoTokenFullURL=\"${ssoTokenBaseURL}/protocol/openid-connect/token\"\n echo -n \"$atlasApiURL\" \u003e \"/tekton/results/atlasApiUrl\"\n echo -n \"$ssoTokenFullURL\" \u003e \"/tekton/results/ssoTokenUrl\"\n echo -n 'release-sso-secret' \u003e \"/tekton/results/secretName\"\n # TSF doesn't use AWS S3, but empty secret names are invalid in K8s\n echo -n 'secret-not-present' \u003e \"/tekton/results/retryAWSSecretName\"\n echo -n '' \u003e \"/tekton/results/retryS3Bucket\"\n echo 'Gathered info from cluster-config, shutting down script.'\n exit 0\n fi\nfi\n\necho 'Gathering data from data file...'\n\nDATA_FILE=\"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\"\nif [ ! -f \"${DATA_FILE}\" ] ; then\n echo \"ERROR: No valid data file was provided.\"\n exit 1\nfi\natlasServer=$(jq -r '(.atlas // .tpa).server' \"$DATA_FILE\")\nif [ \"$atlasServer\" = \"stage\" ]; then\n atlasApiUrl=\"https://atlas.release.stage.devshift.net\"\n ssoTokenUrl=\"https://auth.stage.redhat.com/auth/realms/EmployeeIDP/protocol/openid-connect/token\"\n secretName=$(jq -r \\\n '(.atlas // .tpa).\"atlas-sso-secret-name\" // \"atlas-staging-sso-secret\"' \"$DATA_FILE\")\n retryAWSSecretName=$(jq -r \\\n '(.atlas // .tpa).\"atlas-retry-aws-secret-name\" // \"atlas-retry-s3-staging-secret\"' \"$DATA_FILE\")\n retryS3Bucket=\"mpp-e1-preprod-sbom-29093454-2ea7-4fd0-b4cf-dc69a7529ee0\"\nelif [ \"$atlasServer\" = \"production\" ]; then\n atlasApiUrl=\"https://atlas.release.devshift.net\"\n ssoTokenUrl=\"https://auth.redhat.com/auth/realms/EmployeeIDP/protocol/openid-connect/token\"\n secretName=$(jq -r '(.atlas // .tpa).\"atlas-sso-secret-name\" // \"atlas-prod-sso-secret\"' \"$DATA_FILE\")\n retryAWSSecretName=$(jq -r \\\n '(.atlas // .tpa).\"atlas-retry-aws-secret-name\" // \"atlas-retry-s3-production-secret\"' \"$DATA_FILE\")\n retryS3Bucket=\"mpp-e1-prod-sbom-e02138d3-5c5c-4d90-a38f-6c54f658604d\"\nelif [ \"false\" == 'true' ]; then\n if [ \"$atlasServer\" = \"null\" ]; then\n echo \"ERROR: .(tpa/atlas).server value is missing from the data file. This field is mandatory.\"\n echo \"Consult with your release engineering contact to ask why you are missing this value\"\n exit 1\n else\n echo \"ERROR: Unknown .(tpa/atlas).server value '$atlasServer'. Expected 'stage' or 'production'.\"\n exit 1\n fi\nfi\n\necho -n \"$atlasApiUrl\" \u003e \"/tekton/results/atlasApiUrl\"\necho -n \"$ssoTokenUrl\" \u003e \"/tekton/results/ssoTokenUrl\"\necho -n \"$secretName\" \u003e \"/tekton/results/secretName\"\necho -n \"$retryAWSSecretName\" \u003e \"/tekton/results/retryAWSSecretName\"\necho -n \"$retryS3Bucket\" \u003e \"/tekton/results/retryS3Bucket\"\n" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/47ff6d37-fd69-4d96-afcc-eaa239562e19", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:21:47Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "filter-already-released-images", "tekton.dev/task": "filter-already-released-images" }, "name": "managed-w9dpl-filter-already-released-images", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "12043", "uid": "47ff6d37-fd69-4d96-afcc-eaa239562e19" }, "spec": { "params": [ { "name": "snapshotPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:3faaf3250d4c648fad4aac6ccdf96029714b37270c570fc64495f70025849a11" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/filter-already-released-images/filter-already-released-images.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:21:55Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:21:55Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-filter-already-released-images-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/filter-already-released-images/filter-already-released-images.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "skip_release", "type": "string", "value": "false" }, { "name": "sourceDataArtifact", "type": "string", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:36ef3d8991c9c277b4281eea2121150f250308e1751a8f706c0e42aa5722e6e2" } ], "startTime": "2026-07-03T12:21:47Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://6cc2b8867f778cf4530d69629cd20f2a5bdba200b5d48711965dde1c52e740b9", "exitCode": 0, "finishedAt": "2026-07-03T12:21:52Z", "reason": "Completed", "startedAt": "2026-07-03T12:21:51Z" }, "terminationReason": "Completed" }, { "container": "step-filter-already-released-images", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "filter-already-released-images", "provenance": {}, "terminated": { "containerID": "containerd://3ddd466b14ee9ff9495c4b1987eab60771906258d21e3da17eb3931ee981129f", "exitCode": 0, "finishedAt": "2026-07-03T12:21:53Z", "message": "[{\"key\":\"skip_release\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:53Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://08784f01c662038a3c46ec8da5b7045935339ec171ec910b42284c2b908c5309", "exitCode": 0, "finishedAt": "2026-07-03T12:21:54Z", "message": "[{\"key\":\"skip_release\",\"value\":\"false\",\"type\":1},{\"key\":\"sourceDataArtifact\",\"value\":\"oci:quay-service.quay/test-org/trusted-artifacts@sha256:36ef3d8991c9c277b4281eea2121150f250308e1751a8f706c0e42aa5722e6e2\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:54Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task to filter out images from a snapshot that have already been released.\nThis task checks target registries to determine if push-snapshot has completed successfully\nfor each component by validating that ALL required tags exist with the correct digest.\nComponents that are fully released (all tags present) are filtered out before conforma validation.\n\nTag-level validation ensures complete releases and prevents filtering components with\npartial tag pushes. A component is only filtered if ALL repositories have ALL\nrequired tags pointing to the correct digest.\n\nThe task overwrites the original snapshot file in place with a filtered version\ncontaining only unpublished or partially published images.\n\nThis task must run AFTER apply-mapping since it needs the mapped target repositories\nand their required tags from the enriched snapshot stored in trusted artifacts", "params": [ { "description": "Path to the JSON string of the Snapshot spec in the data workspace", "name": "snapshotPath", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository.\nAn empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "default": "https://github.com/konflux-ci/release-service-catalog.git", "description": "The url to the git repo where the release-service-catalog tasks to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "Whether to skip release tasks (true if all components are already released)", "name": "skip_release", "type": "string" }, { "description": "The location of the source data artifact in the OCI repository", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:3faaf3250d4c648fad4aac6ccdf96029714b37270c570fc64495f70025849a11=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "memory": "1Gi" }, "requests": { "cpu": "250m", "memory": "1Gi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "filter-already-released-images", "script": "#!/usr/bin/env bash\nset -eux\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\nSNAPSHOT_FILE=\"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json\"\n\nif [ ! -f \"${SNAPSHOT_FILE}\" ]; then\n echo \"Error: Snapshot file not found: ${SNAPSHOT_FILE}\"\n exit 1\nfi\n\nSNAPSHOT_JSON=$(cat \"${SNAPSHOT_FILE}\")\nCOMPONENT_COUNT=$(jq '.components | length' \u003c\u003c\u003c \"${SNAPSHOT_JSON}\")\n\nFILTERED_COMPONENTS='[]'\nFILTERED_COUNT=0\n\nfor ((i=0; i\u003cCOMPONENT_COUNT; i++)); do\n COMPONENT=$(jq -c \".components[$i]\" \u003c\u003c\u003c \"${SNAPSHOT_JSON}\")\n COMPONENT_NAME=$(jq -r '.name' \u003c\u003c\u003c \"${COMPONENT}\")\n CONTAINER_IMAGE=$(jq -r '.containerImage' \u003c\u003c\u003c \"${COMPONENT}\")\n\n # Get the component image digest using oras resolve (same as push-snapshot)\n # This ensures we compare manifest index digests, not platform-specific ones\n COMPONENT_AUTH_FILE=$(mktemp)\n if ! select-oci-auth \"${CONTAINER_IMAGE}\" \u003e \"${COMPONENT_AUTH_FILE}\" 2\u003e/dev/null || \\\n [ ! -s \"${COMPONENT_AUTH_FILE}\" ]; then\n echo '{}' \u003e \"${COMPONENT_AUTH_FILE}\"\n fi\n\n # Try to resolve the component image. If this fails for ANY reason\n # (auth, network, not found, etc.), treat as \"not released\"\n if ! DIGEST=$(oras resolve --registry-config \"${COMPONENT_AUTH_FILE}\" \\\n \"${CONTAINER_IMAGE}\" 2\u003e/dev/null); then\n echo \"WARNING: Cannot resolve component image ${CONTAINER_IMAGE}, treating as not yet released\"\n FILTERED_COMPONENTS=$(jq --argjson comp \"${COMPONENT}\" '. += [$comp]' \u003c\u003c\u003c \"${FILTERED_COMPONENTS}\")\n rm -f \"${COMPONENT_AUTH_FILE}\"\n continue\n fi\n rm -f \"${COMPONENT_AUTH_FILE}\"\n\n if [ -z \"${DIGEST}\" ]; then\n echo \"WARNING: Empty digest for ${CONTAINER_IMAGE}, treating as not yet released\"\n FILTERED_COMPONENTS=$(jq --argjson comp \"${COMPONENT}\" '. += [$comp]' \u003c\u003c\u003c \"${FILTERED_COMPONENTS}\")\n continue\n fi\n\n echo \" Component digest: ${DIGEST}\"\n\n # Check if component has repositories (added by apply-mapping)\n REPOSITORIES=$(jq -c '.repositories // []' \u003c\u003c\u003c \"${COMPONENT}\")\n NUM_REPOS=$(jq 'length' \u003c\u003c\u003c \"${REPOSITORIES}\")\n\n if [ \"${NUM_REPOS}\" -eq 0 ]; then\n echo \"WARNING: No repositories found for component ${COMPONENT_NAME}\"\n echo \" Component will be kept (not filtered) since there are no target repos to check\"\n FILTERED_COMPONENTS=$(jq --argjson comp \"${COMPONENT}\" \\\n '. += [$comp]' \u003c\u003c\u003c \"${FILTERED_COMPONENTS}\")\n continue\n fi\n\n echo \"Checking component: ${COMPONENT_NAME} (${NUM_REPOS} target repositories)\"\n\n # Check if ALL required tags exist with correct digest in ANY target repository\n # We consider the component \"released\" if it is fully released to ANY of the\n # mapped registries (i.e., if any repository has all required tags pointing\n # to the same manifest digest).\n ALL_TAGS_COMPLETE=\"false\"\n\n for ((j=0; j\u003cNUM_REPOS; j++)); do\n REPO_OBJ=$(jq -c \".[$j]\" \u003c\u003c\u003c \"${REPOSITORIES}\")\n REPO_URL=$(jq -r '.url // \"\"' \u003c\u003c\u003c \"${REPO_OBJ}\")\n REPO_TAGS=$(jq -c '.tags // []' \u003c\u003c\u003c \"${REPO_OBJ}\")\n\n if [ -z \"${REPO_URL}\" ]; then\n echo \" WARNING: Repository #$((j+1)) has empty URL, skipping\"\n continue\n fi\n\n NUM_TAGS=$(jq 'length' \u003c\u003c\u003c \"${REPO_TAGS}\")\n\n if [ \"${NUM_TAGS}\" -eq 0 ]; then\n echo \" WARNING: Repository ${REPO_URL} has no tags specified, skipping\"\n continue\n fi\n\n echo \" Checking repository: ${REPO_URL} (${NUM_TAGS} tags)\"\n\n REPO_COMPLETE=\"true\"\n for ((k=0; k\u003cNUM_TAGS; k++)); do\n TAG=$(jq -r \".[$k]\" \u003c\u003c\u003c \"${REPO_TAGS}\")\n TARGET_IMAGE=\"${REPO_URL}:${TAG}\"\n\n # Try to create auth file for target registry (optional for public/test registries)\n TARGET_AUTH_FILE=$(mktemp)\n if ! select-oci-auth \"${REPO_URL}\" \u003e \"${TARGET_AUTH_FILE}\" 2\u003e/dev/null || \\\n [ ! -s \"${TARGET_AUTH_FILE}\" ]; then\n # No auth available, use empty config\n echo '{}' \u003e \"${TARGET_AUTH_FILE}\"\n fi\n\n # Try to resolve the target image. If this fails for ANY reason,\n # treat as \"not found\" (repository doesn't exist, tag missing, etc.)\n if ! ACTUAL_DIGEST=$(oras resolve --registry-config \"${TARGET_AUTH_FILE}\" \\\n \"${TARGET_IMAGE}\" 2\u003e/dev/null); then\n echo \" Tag ${TAG}: Cannot resolve (treating as not found)\"\n REPO_COMPLETE=\"false\"\n rm -f \"${TARGET_AUTH_FILE}\"\n break\n fi\n rm -f \"${TARGET_AUTH_FILE}\"\n\n if [ -z \"${ACTUAL_DIGEST}\" ]; then\n # Tag doesn't exist\n echo \" Tag ${TAG}: NOT FOUND\"\n REPO_COMPLETE=\"false\"\n break\n elif [ \"${ACTUAL_DIGEST}\" != \"${DIGEST}\" ]; then\n # Tag exists but points to wrong digest\n echo \" Tag ${TAG}: DIGEST MISMATCH\"\n echo \" Expected: ${DIGEST}\"\n echo \" Found: ${ACTUAL_DIGEST}\"\n REPO_COMPLETE=\"false\"\n break\n else\n echo \" Tag ${TAG}: ✅ MATCH (${ACTUAL_DIGEST})\"\n fi\n done\n\n # If this repository is complete (all tags present and digests matched)\n # then this component can be treated as already released (any-repo logic)\n if [ \"${REPO_COMPLETE}\" == \"true\" ]; then\n ALL_TAGS_COMPLETE=\"true\"\n # We can stop checking other repos, one match is sufficient\n break\n fi\n done\n\n if [ \"${ALL_TAGS_COMPLETE}\" == \"true\" ]; then\n echo \"✅ Component ${COMPONENT_NAME}: FILTERED (already released)\"\n FILTERED_COUNT=$((FILTERED_COUNT + 1))\n else\n echo \"⏭️ Component ${COMPONENT_NAME}: KEPT (needs to be released)\"\n FILTERED_COMPONENTS=$(jq --argjson comp \"${COMPONENT}\" '. += [$comp]' \u003c\u003c\u003c \"${FILTERED_COMPONENTS}\")\n fi\n echo \"\"\ndone\n\n# Update snapshot with filtered components\nFILTERED_SNAPSHOT=$(jq --argjson comps \"${FILTERED_COMPONENTS}\" '.components = $comps' \u003c\u003c\u003c \"${SNAPSHOT_JSON}\")\necho \"${FILTERED_SNAPSHOT}\" \u003e \"${SNAPSHOT_FILE}\"\n\n# Summary\necho \"━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\"\necho \"SUMMARY:\"\necho \" Total components: ${COMPONENT_COUNT}\"\necho \" Filtered (already released): ${FILTERED_COUNT}\"\necho \" To be released: $((COMPONENT_COUNT - FILTERED_COUNT))\"\necho \"━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\"\n\n# Set skip_release=true if all components were filtered\nif [ \"${FILTERED_COUNT}\" -eq \"${COMPONENT_COUNT}\" ] \u0026\u0026 [ \"${COMPONENT_COUNT}\" -gt 0 ]; then\n echo -n \"true\" \u003e \"/tekton/results/skip_release\"\nelse\n echo -n \"false\" \u003e \"/tekton/results/skip_release\"\nfi\n" }, { "args": [ "create", "--store", "quay-service.quay/test-org/trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/aaacadd8-73a9-4b74-b07f-e261f371a3a5", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:22:57Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "make-repo-public", "tekton.dev/task": "make-repo-public" }, "name": "managed-w9dpl-make-repo-public", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "12995", "uid": "aaacadd8-73a9-4b74-b07f-e261f371a3a5" }, "spec": { "params": [ { "name": "dataPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json" }, { "name": "snapshotPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" }, { "name": "registrySecret", "value": "quay-api-token" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:b9941889bb9e23741638aa2a5d30b53170f2bcd794e3cb31cfb503e6f86b0f9c" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" } ], "retries": 5, "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/make-repo-public/make-repo-public.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:23:31Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:23:31Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-make-repo-public-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/make-repo-public/make-repo-public.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "sourceDataArtifact", "type": "string", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a7299562f2184c5fe6b73ed92b0ed1d75286721af69676095aa4dec65bfbd0cb" } ], "startTime": "2026-07-03T12:22:57Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://b66e3b2ed7379e5d8bc5de0ed9d4ebf10e687e1085f67bbe0a9661a60e81f2cd", "exitCode": 0, "finishedAt": "2026-07-03T12:23:28Z", "reason": "Completed", "startedAt": "2026-07-03T12:23:28Z" }, "terminationReason": "Completed" }, { "container": "step-make-repo-public", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:67bb57a671d7e1b8d51ee07cefcca4ac46db02b8c3a9ee8fad60fb9365aab324", "name": "make-repo-public", "provenance": {}, "terminated": { "containerID": "containerd://aa0af57a69ab450fd3ddd3685eec38a9db6b63366bdd4cd72ecb2c9b6f357c3b", "exitCode": 0, "finishedAt": "2026-07-03T12:23:29Z", "reason": "Completed", "startedAt": "2026-07-03T12:23:28Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://16ebd0734a282d9ab22801d83e9db5f00fd75368c131d022e76207ece8b64f8d", "exitCode": 0, "finishedAt": "2026-07-03T12:23:30Z", "message": "[{\"key\":\"sourceDataArtifact\",\"value\":\"oci:quay-service.quay/test-org/trusted-artifacts@sha256:a7299562f2184c5fe6b73ed92b0ed1d75286721af69676095aa4dec65bfbd0cb\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:23:30Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task that makes repositories public using the Quay API", "params": [ { "description": "Path to the merged data JSON file generated by collect-data task", "name": "dataPath", "type": "string" }, { "description": "Path to the JSON string of the Snapshot spec in the data workspace", "name": "snapshotPath", "type": "string" }, { "description": "The kube secret to use the Quay API, containing one key: token", "name": "registrySecret", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "Produced trusted data artifact", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:b9941889bb9e23741638aa2a5d30b53170f2bcd794e3cb31cfb503e6f86b0f9c=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "command": [ "/home/scripts/python/tasks/managed/make_repo_public.py" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "150m", "memory": "256Mi" } }, "env": [ { "name": "DATA_FILE", "value": "/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json" }, { "name": "SNAPSHOT_FILE", "value": "/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" }, { "name": "REGISTRY_SECRET_PATH", "value": "/etc/secrets" }, { "name": "CA_CERT_PATH", "value": "/mnt/trusted-ca/ca-bundle.crt" }, { "name": "REGISTRY_SECRET_NAME", "value": "quay-api-token" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:67bb57a671d7e1b8d51ee07cefcca4ac46db02b8c3a9ee8fad60fb9365aab324", "name": "make-repo-public", "volumeMounts": [ { "mountPath": "/etc/secrets", "name": "registry-secret-vol" } ] }, { "args": [ "create", "--store", "quay-service.quay/test-org/trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "name": "registry-secret-vol", "secret": { "defaultMode": 292, "secretName": "quay-api-token" } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/f11bccca-1f7c-42a0-aa43-9e2dbff43ee1", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:22:23Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "push-snapshot", "tekton.dev/task": "push-snapshot" }, "name": "managed-w9dpl-push-snapshot", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "12614", "uid": "f11bccca-1f7c-42a0-aa43-9e2dbff43ee1" }, "spec": { "params": [ { "name": "snapshotPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" }, { "name": "dataPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json" }, { "name": "resultsDirPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/results" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:36ef3d8991c9c277b4281eea2121150f250308e1751a8f706c0e42aa5722e6e2" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" } ], "retries": 5, "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/push-snapshot/push-snapshot.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:22:57Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:22:57Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-push-snapshot-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/push-snapshot/push-snapshot.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "sourceDataArtifact", "type": "string", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:b9941889bb9e23741638aa2a5d30b53170f2bcd794e3cb31cfb503e6f86b0f9c" } ], "startTime": "2026-07-03T12:22:23Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://2376e7b43384c2b5eb7a5a84b62330aeff3ddbe7696832285d71f9855d8d66f8", "exitCode": 0, "finishedAt": "2026-07-03T12:22:52Z", "reason": "Completed", "startedAt": "2026-07-03T12:22:52Z" }, "terminationReason": "Completed" }, { "container": "step-push-snapshot", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:3cb03b14ac9d90ff27070036ce2b50712e65aa285daeb28852254a745bb25dfc", "name": "push-snapshot", "provenance": {}, "terminated": { "containerID": "containerd://3f5a14ab1f6cee4519b9f64f0df1af0b412a6ed6682985113d3bfd6a1f1f2fdf", "exitCode": 0, "finishedAt": "2026-07-03T12:22:56Z", "reason": "Completed", "startedAt": "2026-07-03T12:22:53Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://9c81482ef50fc3408f8e0cab238284b416ef6849208f9ea0ff5178380dfaed12", "exitCode": 0, "finishedAt": "2026-07-03T12:22:56Z", "message": "[{\"key\":\"sourceDataArtifact\",\"value\":\"oci:quay-service.quay/test-org/trusted-artifacts@sha256:b9941889bb9e23741638aa2a5d30b53170f2bcd794e3cb31cfb503e6f86b0f9c\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:22:56Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task to push snapshot images to an image registry using `cosign copy`.", "params": [ { "description": "Path to the JSON string of the mapped Snapshot spec in the data workspace", "name": "snapshotPath", "type": "string" }, { "description": "Path to the JSON string of the merged data to use in the data workspace", "name": "dataPath", "type": "string" }, { "description": "Path to the results directory in the data workspace", "name": "resultsDirPath", "type": "string" }, { "default": "20", "description": "The maximum number of images to be proccessed concurrently", "name": "concurrentLimit", "type": "string" }, { "default": "3", "description": "Retry copy N times", "name": "retries", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "false", "description": "Enable copying of attached artifacts", "name": "copyBundleMigrations", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "Produced trusted data artifact", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:36ef3d8991c9c277b4281eea2121150f250308e1751a8f706c0e42aa5722e6e2=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "memory": "1Gi" }, "requests": { "cpu": "2", "memory": "1Gi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:3cb03b14ac9d90ff27070036ce2b50712e65aa285daeb28852254a745bb25dfc", "name": "push-snapshot", "script": "#!/usr/bin/env bash\nset -eux\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\npush_image () { # Expected arguments are [origin_digest, name, containerImage, repository, tag, platform]\n # note: Inspection might fail on empty repos, hence `|| true`\n\n # oras has very limited support for selecting the right auth entry,\n # so create a custom auth file with just one entry.\n DEST_AUTH_FILE=$(mktemp)\n registry=$(echo \"$4\" | cut -d '/' -f 1)\n if [ \"$registry\" = \"docker.io\" ]; then\n # For docker.io, the auth key will always be https://index.docker.io/v1/\n select-oci-auth \"$4\" \u003e \"$DEST_AUTH_FILE\"\n else\n # For other registries, the auth key will be modified to the full repository path, so that\n # we can create a combined auth file with source and destination entries for `cosign copy` later\n select-oci-auth \"$4\" | jq -c \\\n '.auths.\"'\"$4\"'\" = .auths.\"'\"$registry\"'\" | del(.auths.\"'\"$registry\"'\")' \u003e \"$DEST_AUTH_FILE\"\n fi\n\n oras_args=()\n if [ -n \"$6\" ]; then\n oras_args=(--platform \"$6\")\n fi\n\n destination_digest=$(oras resolve --registry-config \"$DEST_AUTH_FILE\" \"$4:$5\" || true)\n\n if [[ \"$destination_digest\" != \"$1\" || -z \"$destination_digest\" ]]; then\n printf '* Pushing component: %s to %s:%s\\n' \"$2\" \"$4\" \"$5\"\n # Create a combined auth file to enable partial oci matches to work\n DOCKER_CONFIG=\"$(mktemp -d)\"\n export DOCKER_CONFIG\n # shellcheck disable=SC2128\n jq -s 'reduce .[] as $item ({}; . * $item)' \\\n \"$SOURCE_AUTH_FILE\" \"$DEST_AUTH_FILE\" \u003e \"$DOCKER_CONFIG\"/config.json\n\n # Check if we should copy attached artifacts\n if [[ \"$COPY_BUNDLE_MIGRATIONS\" == \"true\" ]]; then\n # Check for any attached artifacts using oras discover, with retries on failure\n printf '* Checking for attached artifacts on %s\\n' \"$3\"\n artifact_count=\"0\"\n discover_attempt=0\n discover_succeeded=false\n until [ \"$discover_attempt\" -gt \"3\" ]; do # same retry style as copy loop\n if oras discover \\\n --registry-config \"$SOURCE_AUTH_FILE\" \\\n \"$3\" \\\n --format json \\\n \u003e/tmp/artifacts.json\n then\n artifact_count=$(jq -r '.referrers | length' /tmp/artifacts.json || echo \"0\")\n echo \"Found $artifact_count artifacts\"\n discover_succeeded=true\n break\n else\n rc=$?\n echo \"oras discover failed (attempt $((discover_attempt+1))) with exit code $rc\"\n discover_attempt=$((discover_attempt+1))\n fi\n done\n if [ \"$discover_succeeded\" != true ]; then\n echo \"Max retries exceeded. Proceeding without attached artifacts (falling back to cosign copy).\"\n fi\n fi\n\n attempt=0\n until [ \"$attempt\" -gt \"3\" ] ; do # 0 retries by default which will execute this once\n if [[ \"$COPY_BUNDLE_MIGRATIONS\" == \"true\" \u0026\u0026 \"${artifact_count}\" -gt 0 ]]; then\n # Copy the image and all attached artifacts\n oras cp -r \\\n --from-registry-config \"$SOURCE_AUTH_FILE\" \\\n --to-registry-config \"$DEST_AUTH_FILE\" \\\n \"${oras_args[@]}\" \\\n \"$3\" \\\n \"$4:$5\" \\\n \u0026\u0026 break\n else\n # Fallback to classic image copy\n cosign copy -f \"$3\" \"$4:$5\" \u0026\u0026 break\n fi\n attempt=$((attempt+1))\n done\n if [ \"$attempt\" -gt \"3\" ] ; then\n echo \"Max retries exceeded.\"\n exit 1\n fi\n # Only the cosign call above needs this custom Docker config. Unset it, so that skopeo call\n # in get-image-architecture uses the default config in ~/.docker/config.json (this one would break it)\n unset DOCKER_CONFIG\n else\n printf '* Component push skipped (source digest exists at destination): %s (%s)\\n' \\\n \"$2\" \"$3\"\n fi\n jq -n --arg name \"$2\" --arg url \"$4:$5\" '{name: $name, url: $url}' \u003e \"$TMP_RESULTS_DIR/$2-$5.json\"\n}\n\n# Push migration artifact using oras cp\n# Expected arguments are [source_repo, migration_digest, name, repository, migration_tag, source_auth_file]\npush_migration_artifact () {\n local source_repo=\"$1\"\n local migration_digest=\"$2\"\n local name=\"$3\"\n local repository=\"$4\"\n local migration_tag=\"$5\"\n local source_auth_file=\"$6\"\n\n local migration_source=\"${source_repo}@${migration_digest}\"\n\n # Create destination auth file\n local dest_auth_file\n dest_auth_file=$(mktemp)\n local dest_registry\n dest_registry=$(echo \"$repository\" | cut -d '/' -f 1)\n if [ \"$dest_registry\" = \"docker.io\" ]; then\n select-oci-auth \"$repository\" \u003e \"$dest_auth_file\"\n else\n select-oci-auth \"$repository\" | jq -c \\\n '.auths.\"'\"$repository\"'\" = .auths.\"'\"$dest_registry\"'\" | del(.auths.\"'\"$dest_registry\"'\")' \\\n \u003e \"$dest_auth_file\"\n fi\n\n # Check if migration artifact already exists at destination\n local destination_digest\n destination_digest=$(oras resolve --registry-config \"$dest_auth_file\" \\\n \"${repository}:${migration_tag}\" || true)\n\n if [[ \"$destination_digest\" != \"$migration_digest\" || -z \"$destination_digest\" ]]; then\n printf '* Pushing migration artifact for component: %s to %s:%s\\n' \"$name\" \"$repository\" \"$migration_tag\"\n\n local attempt=0\n until [ \"$attempt\" -gt \"3\" ] ; do\n if oras cp \\\n --from-registry-config \"$source_auth_file\" \\\n --to-registry-config \"$dest_auth_file\" \\\n \"$migration_source\" \\\n \"${repository}:${migration_tag}\"\n then\n break\n fi\n attempt=$((attempt+1))\n echo \"Migration artifact copy failed (attempt $attempt)\"\n done\n if [ \"$attempt\" -gt \"3\" ] ; then\n echo \"Max retries exceeded for migration artifact copy.\"\n exit 1\n fi\n else\n printf '* Migration artifact push skipped (already exists at destination): %s (%s)\\n' \\\n \"$name\" \"$migration_source\"\n fi\n}\n\nSNAPSHOT_SPEC_FILE=\"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json\"\nif [ ! -f \"${SNAPSHOT_SPEC_FILE}\" ] ; then\n echo \"No valid snapshot file was provided.\"\n exit 1\nfi\n\nDATA_FILE=\"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/data.json\"\nif [ ! -f \"${DATA_FILE}\" ] ; then\n echo \"No data JSON was provided.\"\n exit 1\nfi\n\nif [ \"$(jq '.components | map(select(.repositories |\n map(select((has(\"tags\")|not) or (.tags | IN([])))) | length \u003e 0)) | length' \\\n \"${SNAPSHOT_SPEC_FILE}\")\" -ne 0 ] ; then\n echo \"Found components in the snapshot file that do not contain tags. Failing\"\n cat \"${SNAPSHOT_SPEC_FILE}\"\n exit 1\nfi\n\nRESULTS_FILE=\"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/results/push-snapshot-results.json\"\nRESULTS_JSON_FILE=$(mktemp)\necho '{\"images\":[]}' \u003e \"$RESULTS_JSON_FILE\"\n\n# Initialize memory throttling\n# This file is located at utils/memory-throttle.sh in the release-service-utils image\n# shellcheck source=/dev/null\nsource memory-throttle.sh\n# This function is stored in the utils/memory-throttle.sh file\nlog_memory_throttle_status 80\n\nRUNNING_JOBS=\"\\j\" # A Bash param for number of jobs running\nCONCURRENT_LIMIT=20\nBURST_SIZE=5\nSTABILIZATION_DELAY=2\nREQUEST_COUNT=0\nSUCCESS=true\njobs_spawned=0\njobs_collected=0\n\n# Wait for a slot to open up in the concurrent limit and for memory to be available\nwait_for_slot () {\n # This function is stored in the utils/memory-throttle.sh file\n # First wait for memory to be available\n wait_for_memory 80\n # Then wait for concurrent limit\n while (( ${RUNNING_JOBS@P} \u003e= \"$CONCURRENT_LIMIT\" )); do\n wait -n || SUCCESS=false\n jobs_collected=$((jobs_collected + 1))\n done\n}\n\n# Create a temporary directory to store the results of each push\nTMP_RESULTS_DIR=$(mktemp -d)\n\ndefaultPushSourceContainer=$(jq -r \\\n '.mapping.defaults.pushSourceContainer | if . == null then true else . end' \"$DATA_FILE\")\nCOPY_BUNDLE_MIGRATIONS=\"false\"\n\ncomponentGroup=$(jq -r '.componentGroup' \"${SNAPSHOT_SPEC_FILE}\")\nNUM_COMPONENTS=$(jq '.components | length' \"${SNAPSHOT_SPEC_FILE}\")\nprintf 'Beginning \"%s\" for \"%s\"\\n\\n' \"managed-w9dpl-push-snapshot\" \"$componentGroup\"\nfor ((i = 0; i \u003c NUM_COMPONENTS; i++))\ndo\n component=$(jq -c --argjson i \"$i\" '.components[$i]' \"${SNAPSHOT_SPEC_FILE}\")\n containerImage=$(jq -r '.containerImage' \u003c\u003c\u003c \"$component\")\n\n # oras has very limited support for selecting the right auth entry,\n # so create a custom auth file with just one entry.\n registry=$(echo \"${containerImage}\" | cut -d '/' -f 1)\n # Apply-mapping ensures that the containerImage contains a sha256 digest\n source_repo=${containerImage%%@sha256:*}\n SOURCE_AUTH_FILE=$(mktemp)\n select-oci-auth \"${containerImage}\" | jq -c \\\n '.auths.\"'\"$source_repo\"'\" = .auths.\"'\"$registry\"'\" | del(.auths.\"'\"$registry\"'\")' \u003e \"$SOURCE_AUTH_FILE\"\n\n arch_json=$(get-image-architectures \"${containerImage}\")\n arches=$(jq -s 'map(.platform.architecture)' \u003c\u003c\u003c \"$arch_json\")\n oses=$(jq -s 'map(.platform.os)' \u003c\u003c\u003c \"$arch_json\")\n\n # Just read the first from the list of architectures\n os=$(jq -r '.[0]' \u003c\u003c\u003c \"$oses\")\n arch=$(jq -r '.[0]' \u003c\u003c\u003c \"$arches\")\n name=$(jq -r '.name' \u003c\u003c\u003c \"$component\")\n media_type=$(skopeo inspect --retry-times 3 --raw \"docker://${containerImage}\" | jq -r .mediaType)\n oras_args=()\n platform=\n if [[ \"$media_type\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" ]]\\\n || [[ \"$media_type\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n platform=$os/$arch\n oras_args=(--platform \"$platform\")\n fi\n\n # we do not use oras_args here since we want to get the manifest index image digest\n origin_digest=$(oras resolve --registry-config \"$SOURCE_AUTH_FILE\" \"${containerImage}\")\n\n jq --arg i \"$i\" --argjson arches \"$arches\" --argjson oses \"$oses\" --arg name \"$name\" \\\n --arg sha \"$origin_digest\" \\\n '.images[$i|tonumber] += {\"arches\": $arches, \"oses\": $oses, \"name\": $name, \"shasum\": $sha, \"urls\": []}' \\\n \"$RESULTS_JSON_FILE\" \u003e \"$RESULTS_JSON_FILE.tmp\" \u0026\u0026 mv \"$RESULTS_JSON_FILE.tmp\" \"$RESULTS_JSON_FILE\"\n\n # Push source container if the component has pushSourceContainer: true or if the\n # pushSourceContainer key is missing from the component and the defaults has\n # pushSourceContainer: true or omitted (defaultPushSourceContainer defaults to true)\n pushSourceContainer=$(jq -r '.pushSourceContainer' \u003c\u003c\u003c \"$component\")\n hasPushSourceContainer=$(jq 'has(\"pushSourceContainer\")' \u003c\u003c\u003c \"$component\")\n\n if [[ \"${pushSourceContainer}\" == \"true\" ]] || [[ \"${hasPushSourceContainer}\" == \"false\" \u0026\u0026 \\\n ${defaultPushSourceContainer} == \"true\" ]] ; then\n source_tag=${origin_digest/:/-}.src\n # Calculate the source container image based on the provided container image\n sourceContainer=\"${source_repo}:${source_tag}\"\n # Check if the source container exists\n source_container_digest=$(oras resolve --registry-config \"$SOURCE_AUTH_FILE\" \\\n \"${sourceContainer}\")\n\n if [ -z \"$source_container_digest\" ] ; then\n echo \"Error: Source container ${sourceContainer} not found!\"\n exit 1\n fi\n fi\n\n # Extract migration annotations if COPY_BUNDLE_MIGRATIONS is enabled\n migration_digest=\"\"\n migration_tag=\"\"\n if [[ \"$COPY_BUNDLE_MIGRATIONS\" == \"true\" ]]; then\n # Annotations are stored as [{name: key, value: value}, ...] in component.metadata.annotations\n migration_digest=$(jq -r '.metadata.annotations // [] |\n map(select(.name == \"dev.konflux-ci.task.migration.digest\")) |\n .[0].value // \"\"' \u003c\u003c\u003c \"$component\")\n migration_tag=$(jq -r '.metadata.annotations // [] |\n map(select(.name == \"dev.konflux-ci.task.migration.tag\")) |\n .[0].value // \"\"' \u003c\u003c\u003c \"$component\")\n if [ -n \"$migration_digest\" ] \u0026\u0026 [ -n \"$migration_tag\" ]; then\n printf '* Found migration annotations for component %s: digest=%s, tag=%s\\n' \\\n \"$name\" \"$migration_digest\" \"$migration_tag\"\n fi\n fi\n\n NUM_REPOS=$(jq -c '.repositories | length' \u003c\u003c\u003c \"$component\")\n for ((j = 0; j \u003c NUM_REPOS; j++)); do\n repository=$(jq -c --argjson j \"$j\" '.repositories[$j]' \u003c\u003c\u003c \"$component\")\n imageTags=$(jq '.tags' \u003c\u003c\u003c \"$repository\")\n repository_url=$(jq -r '.url' \u003c\u003c\u003c \"$repository\")\n\n if [ -n \"${source_container_digest-}\" ] ; then\n # Push the source image with the source tag here. The source image will be\n # pushed with the provided tags below in the loop\n wait_for_slot\n push_image \"${source_container_digest}\" \"${name}\" \"${sourceContainer}\" \\\n \"${repository_url}\" \"${source_tag}\" \"\" \u003e \"$TMP_RESULTS_DIR/${name}-${source_tag}.out\" 2\u003e\u00261 \u0026\n ((++REQUEST_COUNT))\n echo \"Request Count: $REQUEST_COUNT\"\n jobs_spawned=$((jobs_spawned + 1))\n # Allow memory usage to stabilize every BURST_SIZE spawns.\n if (( jobs_spawned % BURST_SIZE == 0 )); then\n sleep $STABILIZATION_DELAY\n fi\n fi\n\n for tag in $(jq -r '.[]' \u003c\u003c\u003c \"$imageTags\") ; do\n wait_for_slot\n # Push the container image\n push_image \"${origin_digest}\" \"${name}\" \"${containerImage}\" \"${repository_url}\" \"${tag}\" \\\n \"$platform\" \u003e \"$TMP_RESULTS_DIR/${name}-${tag}.out\" 2\u003e\u00261 \u0026\n ((++REQUEST_COUNT))\n echo \"Request Count: $REQUEST_COUNT\"\n jobs_spawned=$((jobs_spawned + 1))\n if (( jobs_spawned % BURST_SIZE == 0 )); then\n sleep $STABILIZATION_DELAY\n fi\n\n # This variable will only exist if the above logic determined the source container should\n # be pushed for this component\n if [ -n \"${source_container_digest-}\" ] ; then\n wait_for_slot\n push_image \"${source_container_digest}\" \"${name}\" \"${sourceContainer}\" \\\n \"${repository_url}\" \"${tag}-source\" \"\" \u003e \"$TMP_RESULTS_DIR/${name}-${tag}-source.out\" 2\u003e\u00261 \u0026\n ((++REQUEST_COUNT))\n echo \"Request Count: $REQUEST_COUNT\"\n jobs_spawned=$((jobs_spawned + 1))\n if (( jobs_spawned % BURST_SIZE == 0 )); then\n sleep $STABILIZATION_DELAY\n fi\n fi\n done\n\n # Push migration artifact if annotations are present\n if [[ \"$COPY_BUNDLE_MIGRATIONS\" == \"true\" ]] \u0026\u0026 [ -n \"$migration_digest\" ] \u0026\u0026 [ -n \"$migration_tag\" ]; then\n wait_for_slot\n push_migration_artifact \"${source_repo}\" \"${migration_digest}\" \"${name}\" \\\n \"${repository_url}\" \"${migration_tag}\" \"$SOURCE_AUTH_FILE\" \\\n \u003e \"$TMP_RESULTS_DIR/${name}-migration-${migration_tag}.out\" 2\u003e\u00261 \u0026\n ((++REQUEST_COUNT))\n echo \"Request Count: $REQUEST_COUNT (migration artifact)\"\n jobs_spawned=$((jobs_spawned + 1))\n if (( jobs_spawned % BURST_SIZE == 0 )); then\n sleep $STABILIZATION_DELAY\n fi\n fi\n done\ndone\n\necho \"Waiting for all jobs to complete....\"\n# Use counter to collect all exit codes in case processes finished during a burst sleep\nwhile (( jobs_collected \u003c jobs_spawned )); do\n wait -n || SUCCESS=false\n jobs_collected=$((jobs_collected + 1))\ndone\n\necho \"Printing outputs for each push image\"\nfor file in \"$TMP_RESULTS_DIR\"/*.out; do\n echo \"=== $(basename \"${file}\" .out) ===\"\n cat \"$file\"\n echo\ndone\n\nif [ \"$SUCCESS\" != true ]; then\n echo \"One or more jobs failed. Please check the logs above for details.\"\n exit 1\nfi\n\n# Create a temporary file for the pushes data to avoid command line argument length limits\nPUSHES_FILE=$(mktemp)\njq -s . \"$TMP_RESULTS_DIR\"/*.json \u003e \"$PUSHES_FILE\"\n\n# Use file input instead of command line arguments to avoid argument length limits\njq --slurpfile PUSHES \"$PUSHES_FILE\" '\n reduce $PUSHES[0][] as $p (.; (.images[] | select(.name == $p.name).urls) += [$p.url])\n' \"$RESULTS_JSON_FILE\" | tee \"$RESULTS_FILE\"\n\n# Clean up temporary files\nrm -f \"$RESULTS_JSON_FILE\" \"$RESULTS_JSON_FILE.tmp\" \"$PUSHES_FILE\"\n\nprintf 'Completed \"%s\" for \"%s\"\\n\\n' \"managed-w9dpl-push-snapshot\" \"$componentGroup\"\n" }, { "args": [ "create", "--store", "quay-service.quay/test-org/trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/f4532f30-4914-4733-80f6-4cf4b7e19da2", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:21:11Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "reduce-snapshot", "tekton.dev/task": "reduce-snapshot" }, "name": "managed-w9dpl-reduce-snapshot", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "11568", "uid": "f4532f30-4914-4733-80f6-4cf4b7e19da2" }, "spec": { "params": [ { "name": "SNAPSHOT", "value": "/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "value": "snapshot/snapshot-sample-ac62a10d" }, { "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "value": "ex-registry-sh-ac62a10d" }, { "name": "SNAPSHOT_PATH", "value": "/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/reduce-snapshot/reduce-snapshot.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:21:37Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:21:37Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-reduce-snapshot-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/reduce-snapshot/reduce-snapshot.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "sourceDataArtifact", "type": "string", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:0b466275483c00bfeef00d44b1cf2ea4a4bf89fbde6f6d6baef8cdfccd58419f" } ], "startTime": "2026-07-03T12:21:11Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://c671c0461e58ec69c3237b8c1a688cac0adae4d9a4198ef53d89c5a7d0c734b0", "exitCode": 0, "finishedAt": "2026-07-03T12:21:33Z", "reason": "Completed", "startedAt": "2026-07-03T12:21:33Z" }, "terminationReason": "Completed" }, { "container": "step-ensure-required-labels-present", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "ensure-required-labels-present", "provenance": {}, "terminated": { "containerID": "containerd://fa73bacf68add975af28e4f829ed2082659584c3959daacda63883144af0d824", "exitCode": 0, "finishedAt": "2026-07-03T12:21:34Z", "reason": "Completed", "startedAt": "2026-07-03T12:21:34Z" }, "terminationReason": "Completed" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "provenance": {}, "terminated": { "containerID": "containerd://cc5e80bf02254431c1e3e6f446dc08964b4af645ee76c8b52666cc43782810af", "exitCode": 0, "finishedAt": "2026-07-03T12:21:34Z", "reason": "Completed", "startedAt": "2026-07-03T12:21:34Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://8f7e85c2d4eeb46e86aead9fb38a1754b8a4f38e201c8deaef85c0db9a491f65", "exitCode": 0, "finishedAt": "2026-07-03T12:21:36Z", "message": "[{\"key\":\"sourceDataArtifact\",\"value\":\"oci:quay-service.quay/test-org/trusted-artifacts@sha256:0b466275483c00bfeef00d44b1cf2ea4a4bf89fbde6f6d6baef8cdfccd58419f\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:21:34Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task to reduce a snapshot to a single component based on the component that the snapshot was built for.", "params": [ { "description": "String representation of Snapshot spec", "name": "SNAPSHOT", "type": "string" }, { "description": "Single mode component enabled", "name": "SINGLE_COMPONENT", "type": "string" }, { "description": "Custom Resource to query for built component in Snapshot", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Namespace where Custom Resource is found", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "description": "The location to place the reduced Snapshot", "name": "SNAPSHOT_PATH", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "Produced trusted data artifact", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a2d750a1dc9248b77cfe54a8498859b39e38554a0390883010019e0ccee9f107=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "10m", "memory": "128Mi" } }, "env": [ { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "snapshot/snapshot-sample-ac62a10d" }, { "name": "CUSTOM_RESOURCE_NAMESPACE", "value": "ex-registry-sh-ac62a10d" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "ensure-required-labels-present", "script": "#!/usr/bin/env bash\nset -eu\n\nif [ \"${SINGLE_COMPONENT}\" != \"true\" ]; then\n echo \"Single component mode is not enabled, skipping label check\"\n exit 0\nfi\n\n# Split CUSTOM_RESOURCE (type/name) into resource type and name\nCUSTOM_RESOURCE_TYPE=\"${CUSTOM_RESOURCE%%/*}\"\nCUSTOM_RESOURCE_NAME=\"${CUSTOM_RESOURCE#*/}\"\n\n# Use provided namespace or infer from the pod's current namespace\nif [ -z \"${CUSTOM_RESOURCE_NAMESPACE}\" ]; then\n CUSTOM_RESOURCE_NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)\nfi\n\nLABELS=$(get-resource \"$CUSTOM_RESOURCE_TYPE\" \"${CUSTOM_RESOURCE_NAMESPACE}/${CUSTOM_RESOURCE_NAME}\" \\\n \"{.metadata.labels}\")\nSNAPSHOT_CREATION_TYPE=$(jq -r '.\"test.appstudio.openshift.io/type\" // \"\"' \u003c\u003c\u003c \"${LABELS}\")\nSNAPSHOT_CREATION_COMPONENT=$(jq -r '.\"appstudio.openshift.io/component\" // \"\"' \u003c\u003c\u003c \"${LABELS}\")\n\necho \"SNAPSHOT_CREATION_TYPE: ${SNAPSHOT_CREATION_TYPE}\"\necho \"SNAPSHOT_CREATION_COMPONENT: ${SNAPSHOT_CREATION_COMPONENT}\"\nif [ \"${SNAPSHOT_CREATION_TYPE}\" != \"component\" ] || [ \"${SNAPSHOT_CREATION_COMPONENT}\" == \"\" ]; then\n echo \"Single component mode is enabled, but the snapshot is missing the required labels to use it.\"\n echo \"This is likely due to a manually created snapshot\"\n echo \"The test.appstudio.openshift.io/type label must exist with value component\"\n echo \"The appstudio.openshift.io/component label must also exist saying which component to use\"\n echo \"Failing the pipelineRun to prevent unexpected behavior in future tasks\"\n exit 1\nfi\n" }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "10m", "memory": "128Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "snapshot/snapshot-sample-ac62a10d" }, { "name": "CUSTOM_RESOURCE_NAMESPACE", "value": "ex-registry-sh-ac62a10d" }, { "name": "SNAPSHOT_PATH", "value": "/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "onError": "continue" }, { "args": [ "create", "--store", "quay-service.quay/test-org/trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/93a67ed3-abd2-4e43-ab70-251386b98d5f", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:22:57Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "update-cr-status", "tekton.dev/task": "update-cr-status" }, "name": "managed-w9dpl-update-cr-status", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "12788", "uid": "93a67ed3-abd2-4e43-ab70-251386b98d5f" }, "spec": { "params": [ { "name": "resource", "value": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7" }, { "name": "resultsDirPath", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/results" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "resultArtifacts", "value": [ "oci:quay-service.quay/test-org/trusted-artifacts@sha256:b9941889bb9e23741638aa2a5d30b53170f2bcd794e3cb31cfb503e6f86b0f9c=/var/workdir/release" ] }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/update-cr-status/update-cr-status.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:23:10Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:23:10Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-update-cr-status-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/update-cr-status/update-cr-status.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "startTime": "2026-07-03T12:22:57Z", "steps": [ { "container": "step-use-trusted-artifact-array", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact-array", "provenance": {}, "terminated": { "containerID": "containerd://1508b7973bf1e75a8bfc8d9e4104f5a4705bc49cf91318bc448556eb0736c5c8", "exitCode": 0, "finishedAt": "2026-07-03T12:23:05Z", "reason": "Completed", "startedAt": "2026-07-03T12:23:05Z" }, "terminationReason": "Completed" }, { "container": "step-update-cr-status", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "update-cr-status", "provenance": {}, "terminated": { "containerID": "containerd://cfd9741bf5518fde7d96263f77cf6a9f04c913f524e740ac1359107044bfebe4", "exitCode": 0, "finishedAt": "2026-07-03T12:23:07Z", "reason": "Completed", "startedAt": "2026-07-03T12:23:06Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "A tekton task that updates the passed CR status with the contents stored in the files in the resultsDir.", "params": [ { "default": "release", "description": "The type of resource that is being patched", "name": "resourceType", "type": "string" }, { "default": "artifacts", "description": "The top level key to overwrite in the resource status", "name": "statusKey", "type": "string" }, { "description": "The namespaced name of the resource to be patched", "name": "resource", "type": "string" }, { "description": "Path to the directory containing the result files in the data workspace which will be added to the\nresource's status\n", "name": "resultsDirPath", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": [], "description": "Array of artifacts to use to obtain results", "name": "resultArtifacts", "type": "array" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:b9941889bb9e23741638aa2a5d30b53170f2bcd794e3cb31cfb503e6f86b0f9c=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "20m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact-array" }, { "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "50m", "memory": "128Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "update-cr-status", "script": "#!/usr/bin/env bash\nset -ex\n\nRESULTS_DIR=\"/var/workdir/release/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/results\"\nTEMP_FILE=\"/tmp/temp.json\"\nRESULTS_JSON=\"/tmp/results.json\"\necho '{}' \u003e \"$RESULTS_JSON\"\n\nfor resultsFile in $([ -d \"$RESULTS_DIR\" ] \u0026\u0026 find \"$RESULTS_DIR\" -type f); do\n if ! jq . \u003e/dev/null 2\u003e\u00261 \"${resultsFile}\" ; then\n echo \"Passed results JSON file ${resultsFile} in results directory was not proper JSON.\"\n exit 1\n fi\n\n # Merge with array concatenation for array fields and object merging\n jq --slurpfile new \"${resultsFile}\" '\n # Store current values as $base and get all unique keys from both objects\n . as $base | ($base | keys + ($new[0] | keys)) | unique |\n # Process each key and build the merged result\n reduce .[] as $key ({}; . + {($key): (\n # Case 1: Both values are arrays - concatenate them\n if ($new[0][$key] | type == \"array\") and ($base[$key] | type == \"array\")\n then $base[$key] + $new[0][$key]\n else\n # Case 2: Both values are objects - merge them recursively\n if ($new[0][$key] | type == \"object\") and ($base[$key] | type == \"object\")\n then $base[$key] * $new[0][$key]\n # Case 3: Default - use new value or fall back to base value\n else $new[0][$key] // $base[$key]\n end\n end\n )})\n ' \"$RESULTS_JSON\" \u003e \"$TEMP_FILE\"\n mv \"$TEMP_FILE\" \"$RESULTS_JSON\"\ndone\n\n# Read the final JSON from the file\nFINAL_JSON=$(cat \"$RESULTS_JSON\")\n\nIFS='/' read -r namespace name \u003c\u003c\u003c \"ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7\"\n\n# Create patch file to avoid \"Argument list too long\" error\nPATCH_FILE=\"/tmp/patch-$(date +%s).json\"\necho \"status: {'artifacts':${FINAL_JSON}}\" \u003e \"$PATCH_FILE\"\n\nkubectl --warnings-as-errors=true patch \"release\" -n \"$namespace\" \"$name\" \\\n --type=merge --subresource status --patch-file \"$PATCH_FILE\"\n\n# Clean up\nrm -f \"$PATCH_FILE\"\n" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/723d4f0c-3cc1-4f4a-8316-3a9a433f056b", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:19:45Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "verify-access-to-resources", "tekton.dev/task": "verify-access-to-resources" }, "name": "managed-w9dpl-verify-access-to-resources", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "10470", "uid": "723d4f0c-3cc1-4f4a-8316-3a9a433f056b" }, "spec": { "params": [ { "name": "release", "value": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7" }, { "name": "releasePlan", "value": "ex-registry-sh-ac62a10d/source-releaseplan" }, { "name": "releasePlanAdmission", "value": "ex-registry-sh-managed-ac62a10d/demo" }, { "name": "releaseServiceConfig", "value": "release-service/release-service-config" }, { "name": "snapshot", "value": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d" }, { "name": "requireInternalServices", "value": "false" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, { "name": "pathInRepo", "value": "tasks/managed/verify-access-to-resources/verify-access-to-resources.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:20:19Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:20:19Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-verify-access-to-resources-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bd80323ebdcec16651470f96ed8ba226a13ca7bb" }, "entryPoint": "tasks/managed/verify-access-to-resources/verify-access-to-resources.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "startTime": "2026-07-03T12:19:45Z", "steps": [ { "container": "step-verify-access-to-resources", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "verify-access-to-resources", "provenance": {}, "terminated": { "containerID": "containerd://13f17f78fd896638620fe5bd45f4d1b288e31c445aa504e2e066889fff985a3d", "exitCode": 0, "finishedAt": "2026-07-03T12:20:16Z", "reason": "Completed", "startedAt": "2026-07-03T12:20:16Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This Tekton task is used to verify access to various resources in the pipelines. It ensures that the necessary\nresources, such as the release, release plan, release plan admission, release service config and snapshot,\nare available and accessible. Additionally, it checks if internal requests can be created if\n`requireInternalServices` is set to `true`.", "params": [ { "description": "Namespace/name of the Release", "name": "release", "type": "string" }, { "description": "Namespace/name of the ReleasePlan", "name": "releasePlan", "type": "string" }, { "description": "Namespace/name of the ReleasePlanAdmission", "name": "releasePlanAdmission", "type": "string" }, { "description": "Namespace/name of the ReleaseServiceConfig", "name": "releaseServiceConfig", "type": "string" }, { "description": "Namespace/name of the Snapshot", "name": "snapshot", "type": "string" }, { "default": "false", "description": "Whether internal services are required", "name": "requireInternalServices", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "stepTemplate": { "computeResources": {}, "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "computeResources": { "limits": { "memory": "100Mi" }, "requests": { "cpu": "10m", "memory": "100Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "verify-access-to-resources", "script": "#!/usr/bin/env bash\n\nORIGIN_NAMESPACE=\"$(cut -f1 -d/ \u003c\u003c\u003c \"ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7\")\"\nTARGET_NAMESPACE=\"$(cut -f1 -d/ \u003c\u003c\u003c \"ex-registry-sh-managed-ac62a10d/demo\")\"\nRSC_NAMESPACE=\"$(cut -f1 -d/ \u003c\u003c\u003c \"release-service/release-service-config\")\"\n\nRELEASE_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7\")\"\nRELEASEPLAN_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-ac62a10d/source-releaseplan\")\"\nRELEASEPLANADMISSION_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-managed-ac62a10d/demo\")\"\nRELEASESERVICECONFIG_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"release-service/release-service-config\")\"\nSNAPSHOT_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d\")\"\n\nCAN_I_READ_RELEASES=\"$(kubectl auth can-i get release/\"${RELEASE_NAME}\" -n \"${ORIGIN_NAMESPACE}\")\"\nCAN_I_READ_RELEASEPLANS=\"$(kubectl auth can-i get releaseplan/\"${RELEASEPLAN_NAME}\"\\\n -n \"${ORIGIN_NAMESPACE}\")\"\nCAN_I_READ_RELEASEPLANADMISSIONS=\"$(kubectl auth can-i get\\\n releaseplanadmission/\"${RELEASEPLANADMISSION_NAME}\" -n \"${TARGET_NAMESPACE}\")\"\nCAN_I_READ_RELEASESERVICECONFIG=\"$(kubectl auth can-i get\\\n releaseserviceconfig/\"${RELEASESERVICECONFIG_NAME}\" -n \"${RSC_NAMESPACE}\")\"\nCAN_I_READ_SNAPSHOTS=\"$(kubectl auth can-i get snapshot/\"${SNAPSHOT_NAME}\" -n \"${ORIGIN_NAMESPACE}\")\"\n\nif [ \"false\" = \"true\" ]; then\n CAN_I_CREATE_INTERNALREQUESTS=\"$(kubectl auth can-i create internalrequest -n \"${TARGET_NAMESPACE}\")\"\nelse\n CAN_I_CREATE_INTERNALREQUESTS=\"skipped\"\nfi\n\necho \"\"\necho \"CAN_I_READ_RELEASES? ${CAN_I_READ_RELEASES}\"\necho \"CAN_I_READ_RELEASEPLANS? ${CAN_I_READ_RELEASEPLANS}\"\necho \"CAN_I_READ_RELEASEPLANADMISSIONS? ${CAN_I_READ_RELEASEPLANADMISSIONS}\"\necho \"CAN_I_READ_RELEASESERVICECONFIG? ${CAN_I_READ_RELEASESERVICECONFIG}\"\necho \"CAN_I_READ_SNAPSHOTS? ${CAN_I_READ_SNAPSHOTS}\"\necho \"\"\necho \"CAN_I_CREATE_INTERNALREQUESTS? ${CAN_I_CREATE_INTERNALREQUESTS}\"\necho \"\"\n\nif [ \"${CAN_I_READ_RELEASES}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_RELEASEPLANS}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_RELEASEPLANADMISSIONS}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_RELEASESERVICECONFIG}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_SNAPSHOTS}\" = \"no\" ] ||\\\n [ \"${CAN_I_CREATE_INTERNALREQUESTS}\" = \"no\" ] ; then\n echo \"Error: Cannot read or create required Release resources!\"\n echo \"\"\n echo \"This indicates that your workspace is not correctly setup\"\n echo \"Please reach out to a workspace administrator\"\n exit 1\nfi\n\necho \"Access to Release resources verified\"\n" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-ac62a10d/snapshot-sample-ac62a10d-kt8p7", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/records/e1cc5a04-d1ab-4826-8273-a9693caf1023", "results.tekton.dev/result": "ex-registry-sh-managed-ac62a10d/results/8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Conforma in Konflux", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-03T12:21:56Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-ac62a10d", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "snapshot-sample-ac62a10d-kt8p7", "release.appstudio.openshift.io/namespace": "ex-registry-sh-ac62a10d", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-w9dpl", "tekton.dev/pipelineRunUID": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7", "tekton.dev/pipelineTask": "verify-conforma", "tekton.dev/task": "verify-conforma-konflux-ta" }, "name": "managed-w9dpl-verify-conforma", "namespace": "ex-registry-sh-managed-ac62a10d", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-w9dpl", "uid": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7" } ], "resourceVersion": "12326", "uid": "e1cc5a04-d1ab-4826-8273-a9693caf1023" }, "spec": { "params": [ { "name": "SNAPSHOT_FILENAME", "value": "8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Release Policies\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"],\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\"],\"config\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\",\"slsa_source_correlated.source_code_reference_provided\"],\"include\":[\"@slsa3\"]}}],\"publicKey\":\"k8s://ex-registry-sh-managed-ac62a10d/cosign-public-key\"}" }, { "name": "STRICT", "value": "true" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "EXTRA_RULE_DATA", "value": "pipeline_intention=release" }, { "name": "WORKERS", "value": "4" }, { "name": "SOURCE_DATA_ARTIFACT", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:36ef3d8991c9c277b4281eea2121150f250308e1751a8f706c0e42aa5722e6e2" }, { "name": "TRUSTED_ARTIFACTS_DEBUG", "value": "" }, { "name": "CERTIFICATE_IDENTITY", "value": "" }, { "name": "CERTIFICATE_OIDC_ISSUER", "value": "" }, { "name": "TUF_MIRROR", "value": "" }, { "name": "REKOR_HOST", "value": "" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/conforma/tekton-catalog" }, { "name": "revision", "value": "2c1963225e8563194a8dce7f659c71bd866da426" }, { "name": "pathInRepo", "value": "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml" } ], "resolver": "git" }, "timeout": "4h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-03T12:22:23Z", "conditions": [ { "lastTransitionTime": "2026-07-03T12:22:23Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-w9dpl-verify-conforma-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "2c1963225e8563194a8dce7f659c71bd866da426" }, "entryPoint": "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml", "uri": "git+https://github.com/conforma/tekton-catalog" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1783081341\",\"namespace\":\"\",\"successes\":21,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n" }, { "name": "VSA_GENERATED", "type": "string", "value": "false" } ], "startTime": "2026-07-03T12:21:56Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://31feff767079acd906030fe15d7c97625cafc77b0fc4585e9685cc1b93d021e0", "exitCode": 0, "finishedAt": "2026-07-03T12:22:08Z", "reason": "Completed", "startedAt": "2026-07-03T12:22:07Z" }, "terminationReason": "Completed" }, { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "containerd://9005e5756044685c7b06b1df63e98d98b411323217ba6929d910f7693f422306", "exitCode": 0, "finishedAt": "2026-07-03T12:22:09Z", "reason": "Completed", "startedAt": "2026-07-03T12:22:09Z" }, "terminationReason": "Completed" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "provenance": {}, "terminated": { "containerID": "containerd://d57bf76e8d0dbee888c8e72398e0601cf08562a303b84405af7f9425cac48b0d", "exitCode": 0, "finishedAt": "2026-07-03T12:22:09Z", "reason": "Completed", "startedAt": "2026-07-03T12:22:09Z" }, "terminationReason": "Completed" }, { "container": "step-pin-policy-bundle", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "pin-policy-bundle", "provenance": {}, "terminated": { "containerID": "containerd://6e93f8d51ff2211ff306d92e277d9bb012c1c7cbf370f09b5b3285bd9eeca87b", "exitCode": 0, "finishedAt": "2026-07-03T12:22:09Z", "reason": "Completed", "startedAt": "2026-07-03T12:22:09Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "validate", "provenance": {}, "terminated": { "containerID": "containerd://78872fa96eefe3d54ff06e4286ebe3978a04c372ee50bc638d6ab1a11ad1c98f", "exitCode": 0, "finishedAt": "2026-07-03T12:22:21Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783081341\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":21,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:22:09Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "report-json", "provenance": {}, "terminated": { "containerID": "containerd://0edd6b7a177c741b2b9ac4da2404e95d513e2305aa0bb74c51d5b2d5d675f8c3", "exitCode": 0, "finishedAt": "2026-07-03T12:22:21Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783081341\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":21,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:22:21Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "summary", "provenance": {}, "terminated": { "containerID": "containerd://a93d4c21e98a1c6117e1c896bdc12c5cc202d949d73c09a486e23bfcd99bf9b0", "exitCode": 0, "finishedAt": "2026-07-03T12:22:21Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783081341\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":21,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:22:21Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "version", "provenance": {}, "terminated": { "containerID": "containerd://2fad3dce840edb86bc0d3281fb5a1a1511cb164677c8a573a00371b9856941b4", "exitCode": 0, "finishedAt": "2026-07-03T12:22:21Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783081341\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":21,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:22:21Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "show-config", "provenance": {}, "terminated": { "containerID": "containerd://1dddea7e19aae2fe73e2598ba0f8bb6bfe1983b449bcb385aab99609c83a6f01", "exitCode": 0, "finishedAt": "2026-07-03T12:22:21Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783081341\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":21,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:22:21Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "containerd://1e048defd9c471ebd4863c8b2a78cae8d24cdbb99dde6204d727a12174b75ffe", "exitCode": 0, "finishedAt": "2026-07-03T12:22:22Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783081341\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":21,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:22:22Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "assert", "provenance": {}, "terminated": { "containerID": "containerd://997e3d3e6d3f3d53264a84e6d0b86a01867878c431fc11c80a43ecbb43f84095", "exitCode": 0, "finishedAt": "2026-07-03T12:22:22Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783081341\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":21,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-03T12:22:22Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://7a906df10395a598c208249467d33789624991263d230d5a03e065694499402a", "exitCode": 0, "finishedAt": "2026-07-03T12:22:22Z", "reason": "Completed", "startedAt": "2026-07-03T12:22:22Z" }, "terminationReason": "Skipped" } ], "taskSpec": { "description": "Verify the Conforma policy is met", "params": [ { "description": "The filename of the `Snapshot` that is located within the trusted artifact\n", "name": "SNAPSHOT_FILENAME", "type": "string" }, { "description": "Trusted Artifact to use to obtain the Snapshot to validate.\n", "name": "SOURCE_DATA_ARTIFACT", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "sha256:6f4d4b9bf0a4f5ca7768ef7c47c56c4b324ca4b1f8f5162b04b341fdb562f17a", "description": "Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@\u003cdigest\u003e. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...).", "name": "POLICY_BUNDLE_DIGEST", "type": "string" }, { "default": "4", "description": "Number of parallel workers to use for policy evaluation.\n", "name": "WORKERS", "type": "string" }, { "default": "", "description": "Use the OPA evaluator instead of the default conftest evaluator. Set to \"1\" to enable.", "name": "EC_USE_OPA", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "ORAS_OPTIONS", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable.", "name": "TRUSTED_ARTIFACTS_DEBUG", "type": "string" }, { "default": "/var/workdir/conforma", "description": "Directory to use to extract trusted artifact archive.", "name": "TRUSTED_ARTIFACTS_EXTRACT_DIR", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" }, { "default": "false", "description": "Enable VSA generation", "name": "ENABLE_VSA", "type": "string" }, { "default": "dsse", "description": "Attestation format: dsse (signed envelope) or predicate (raw JSON)", "name": "ATTESTATION_FORMAT", "type": "string" }, { "default": "", "description": "Signing key for format=dsse (k8s:// or file:// URL)", "name": "VSA_SIGNING_KEY", "type": "string" }, { "default": "local@/var/workdir/conforma/vsa", "description": "VSA upload destination", "name": "VSA_UPLOAD", "type": "string" }, { "default": "", "description": "OCI storage URL for trusted artifacts", "name": "ociStorage", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Whether VSAs were generated (true/false)", "name": "VSA_GENERATED", "type": "string" }, { "description": "Trusted Artifact URI containing VSA files", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" }, { "name": "HOME", "value": "/tekton/home" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:36ef3d8991c9c277b4281eea2121150f250308e1751a8f706c0e42aa5722e6e2=/var/workdir/conforma" ], "computeResources": {}, "env": [ { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": {}, "env": [ { "name": "TUF_MIRROR" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "initialize-tuf", "script": "set -euo pipefail\n\nif [[ -z \"${TUF_MIRROR:-}\" ]]; then\n echo 'TUF_MIRROR parameter not provided. Skipping TUF root initialization.'\n exit\nfi\n\necho 'Initializing TUF root...'\nec sigstore initialize --mirror \"${TUF_MIRROR}\" --root \"${TUF_MIRROR}/root.json\"\necho 'Done!'" }, { "command": [ "reduce-snapshot.sh" ], "computeResources": {}, "env": [ { "name": "SNAPSHOT", "value": "/var/workdir/conforma/8f02b3b8-8df6-4f92-88ef-58b2c26430d7/snapshot_spec.json" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "onError": "continue" }, { "command": [ "pin-konflux-policy-bundle.sh" ], "computeResources": {}, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Release Policies\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"],\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\"],\"config\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\",\"slsa_source_correlated.source_code_reference_provided\"],\"include\":[\"@slsa3\"]}}],\"publicKey\":\"k8s://ex-registry-sh-managed-ac62a10d/cosign-public-key\"}" }, { "name": "POLICY_BUNDLE_DIGEST", "value": "sha256:6f4d4b9bf0a4f5ca7768ef7c47c56c4b324ca4b1f8f5162b04b341fdb562f17a" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "pin-policy-bundle", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "250m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Release Policies\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"],\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\"],\"config\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\",\"slsa_source_correlated.source_code_reference_provided\"],\"include\":[\"@slsa3\"]}}],\"publicKey\":\"k8s://ex-registry-sh-managed-ac62a10d/cosign-public-key\"}" }, { "name": "PUBLIC_KEY" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "4" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA", "value": "pipeline_intention=release" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "ENABLE_VSA", "value": "false" }, { "name": "ATTESTATION_FORMAT", "value": "dsse" }, { "name": "VSA_SIGNING_KEY" }, { "name": "VSA_UPLOAD", "value": "local@/var/workdir/conforma/vsa" }, { "name": "EC_USE_OPA" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\n# Use policy override file if pin-policy-bundle produced one\nif [[ -f \"${HOMEDIR}/policy-with-pinned-bundle.yaml\" ]]; then\n POLICY_CONFIGURATION=\"${HOMEDIR}/policy-with-pinned-bundle.yaml\"\nfi\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n# Add VSA arguments if enabled\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n cmd_args+=(\n --vsa=\"true\"\n --attestation-format=\"${ATTESTATION_FORMAT}\"\n )\n\n\n if [[ \"${ATTESTATION_FORMAT}\" == \"dsse\" ]]; then\n if [[ -z \"${VSA_SIGNING_KEY}\" ]]; then\n echo \"ERROR: VSA_SIGNING_KEY required for format=dsse\" \u003e\u00262\n exit 1\n fi\n cmd_args+=(\n --vsa-signing-key=\"${VSA_SIGNING_KEY}\"\n --vsa-upload=\"${VSA_UPLOAD}\"\n )\n fi\n\n # ec requires --attestation-output-dir to be under /tmp or cwd.\n # Write there first, then copy to the workdir so\n # create-trusted-artifact includes them in the archive.\n VSA_TMP_DIR=\"/tmp/vsa-output\"\n mkdir -p \"$VSA_TMP_DIR\"\n cmd_args+=(\n --attestation-output-dir=\"$VSA_TMP_DIR\"\n )\n\n echo -n \"true\" \u003e /tekton/results/VSA_GENERATED\nelse\n echo -n \"false\" \u003e /tekton/results/VSA_GENERATED\nfi\n\n# Execute Conforma with constructed arguments\nec \"${cmd_args[@]}\"\n\n# Copy VSA output from /tmp to workdir for trusted artifact archival\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n # Extract local path from VSA_UPLOAD for output directory\n # VSA_UPLOAD format is \"local@/path/to/dir\"\n # Fixme: Because of -o pipefail this will fail the whole task when the grep doesn't match\n VSA_LOCAL_PATH=$(echo \"${VSA_UPLOAD}\" | grep -oE '^local@[^ ]+' | sed 's/^local@//' | head -n1 || true)\n if [[ -n \"$VSA_LOCAL_PATH\" \u0026\u0026 -d \"/tmp/vsa-output\" ]]; then\n mkdir -p \"$VSA_LOCAL_PATH\"\n cp -r /tmp/vsa-output/* \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n # Include raw JSON report for downstream SLSA VSA generation\n cp \"${HOMEDIR}/report-json.json\" \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n fi\nfi\n" }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "assert" }, { "args": [ "create", "--store", "", "/tekton/results/sourceDataArtifact=/var/workdir/conforma" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "when": [ { "input": "false", "operator": "in", "values": [ "true" ] }, { "operator": "notin", "values": [ "", "empty" ] } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }