{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "final-finalizer-dev-b835/snapshot-sample-vjzy-d499148-rg72n", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "final-finalizer-dev-b835/results/394f8034-2884-4b09-8ff9-f3cbd3908d4a/records/8a119115-d7fe-4cfc-8df3-17d4a6fc9a3b", "results.tekton.dev/result": "final-finalizer-dev-b835/results/394f8034-2884-4b09-8ff9-f3cbd3908d4a", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "e2e" }, "creationTimestamp": "2026-08-14T17:56:59Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-08-14T17:57:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-vjzy", "pipelines.appstudio.openshift.io/type": "final", "release.appstudio.openshift.io/name": "snapshot-sample-vjzy-d499148-rg72n", "release.appstudio.openshift.io/namespace": "final-finalizer-dev-b835", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "simple-pipeline", "tekton.dev/pipelineRun": "final-p668z", "tekton.dev/pipelineRunUID": "394f8034-2884-4b09-8ff9-f3cbd3908d4a", "tekton.dev/pipelineTask": "hello-world" }, "name": "final-p668z-hello-world", "namespace": "final-finalizer-dev-b835", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "final-p668z", "uid": "394f8034-2884-4b09-8ff9-f3cbd3908d4a" } ], "resourceVersion": "11834", "uid": "8a119115-d7fe-4cfc-8df3-17d4a6fc9a3b" }, "spec": { "params": [ { "name": "MESSAGE", "value": "hello world" } ], "serviceAccountName": "final-finalizer-service-account", "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho $(params.MESSAGE) \n" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-14T17:57:05Z", "conditions": [ { "lastTransitionTime": "2026-08-14T17:57:05Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "final-p668z-hello-world-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-08-14T17:56:59Z", "steps": [ { "container": "step-echo-message", "imageID": "registry.access.redhat.com/ubi9/ubi@sha256:9460515b85f2a75278f2043438583c1c377c44bf100178bb653a6c8658304ac7", "name": "echo-message", "provenance": {}, "terminated": { "containerID": "containerd://49a1c6e5dc22520c1315017e616e13a5035d9239037767d0a25a6e3ddabc2732", "exitCode": 0, "finishedAt": "2026-08-14T17:57:04Z", "reason": "Completed", "startedAt": "2026-08-14T17:57:04Z" }, "terminationReason": "Completed" } ], "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho hello world \n" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "final-finalizer-dev-b835/snapshot-sample-vjzy-d499148-xwd8b", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "final-finalizer-dev-b835/results/fe6fa380-adae-4b46-b650-09840b87c85a/records/81d5ca87-a95c-4fdc-868a-cbec93348258", "results.tekton.dev/result": "final-finalizer-dev-b835/results/fe6fa380-adae-4b46-b650-09840b87c85a", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "e2e" }, "creationTimestamp": "2026-08-14T17:56:59Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-08-14T17:57:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-vjzy", "pipelines.appstudio.openshift.io/type": "final", "release.appstudio.openshift.io/name": "snapshot-sample-vjzy-d499148-xwd8b", "release.appstudio.openshift.io/namespace": "final-finalizer-dev-b835", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "simple-pipeline", "tekton.dev/pipelineRun": "final-x2q7w", "tekton.dev/pipelineRunUID": "fe6fa380-adae-4b46-b650-09840b87c85a", "tekton.dev/pipelineTask": "hello-world" }, "name": "final-x2q7w-hello-world", "namespace": "final-finalizer-dev-b835", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "final-x2q7w", "uid": "fe6fa380-adae-4b46-b650-09840b87c85a" } ], "resourceVersion": "11836", "uid": "81d5ca87-a95c-4fdc-868a-cbec93348258" }, "spec": { "params": [ { "name": "MESSAGE", "value": "hello world" } ], "serviceAccountName": "final-finalizer-service-account", "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho $(params.MESSAGE) \n" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-14T17:57:05Z", "conditions": [ { "lastTransitionTime": "2026-08-14T17:57:05Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "final-x2q7w-hello-world-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-08-14T17:56:59Z", "steps": [ { "container": "step-echo-message", "imageID": "registry.access.redhat.com/ubi9/ubi@sha256:9460515b85f2a75278f2043438583c1c377c44bf100178bb653a6c8658304ac7", "name": "echo-message", "provenance": {}, "terminated": { "containerID": "containerd://88fd10ba1c33c2b999b75e903a87e808f9dc594e348b1b468960c968ca6eb3c9", "exitCode": 0, "finishedAt": "2026-08-14T17:57:04Z", "reason": "Completed", "startedAt": "2026-08-14T17:57:04Z" }, "terminationReason": "Completed" } ], "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho hello world \n" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "final-finalizer-dev-b835/snapshot-sample-vjzy-d499148-xwd8b", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "final-finalizer-managed-failure/results/463e81f5-450b-4e51-a3b3-e1f368fee8c1/records/960db696-59e2-4c8c-912e-cae52f905c3a", "results.tekton.dev/result": "final-finalizer-managed-failure/results/463e81f5-450b-4e51-a3b3-e1f368fee8c1", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "e2e, fail" }, "creationTimestamp": "2026-08-14T17:56:43Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-08-14T17:57:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-vjzy", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-vjzy-d499148-xwd8b", "release.appstudio.openshift.io/namespace": "final-finalizer-dev-b835", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "failing-pipeline", "tekton.dev/pipelineRun": "managed-cqdtd", "tekton.dev/pipelineRunUID": "463e81f5-450b-4e51-a3b3-e1f368fee8c1", "tekton.dev/pipelineTask": "fail-task" }, "name": "managed-cqdtd-fail-task", "namespace": "final-finalizer-managed-failure", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-cqdtd", "uid": "463e81f5-450b-4e51-a3b3-e1f368fee8c1" } ], "resourceVersion": "11833", "uid": "960db696-59e2-4c8c-912e-cae52f905c3a" }, "spec": { "serviceAccountName": "release-service-account", "taskSpec": { "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "fail", "script": "#!/usr/bin/env sh\n\nexit 1\n" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-14T17:56:57Z", "conditions": [ { "lastTransitionTime": "2026-08-14T17:56:57Z", "message": "\"step-fail\" exited with code 1: Error", "reason": "Failed", "status": "False", "type": "Succeeded" } ], "podName": "managed-cqdtd-fail-task-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-08-14T17:56:43Z", "steps": [ { "container": "step-fail", "imageID": "registry.access.redhat.com/ubi9/ubi@sha256:9460515b85f2a75278f2043438583c1c377c44bf100178bb653a6c8658304ac7", "name": "fail", "provenance": {}, "terminated": { "containerID": "containerd://d2761d21115abb0828b0a4b5c13b9e9a691d9f29bd612ce6b7f6836984409034", "exitCode": 1, "finishedAt": "2026-08-14T17:56:55Z", "reason": "Error", "startedAt": "2026-08-14T17:56:55Z" }, "terminationReason": "Error" } ], "taskSpec": { "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "fail", "script": "#!/usr/bin/env sh\n\nexit 1\n" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "final-finalizer-dev-b835/snapshot-sample-vjzy-d499148-rg72n", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "final-finalizer-managed-success/results/3c409bbf-e6e4-48e5-bb87-f44e9657f122/records/3132e54e-0087-4e5d-8293-52ab45c27b78", "results.tekton.dev/result": "final-finalizer-managed-success/results/3c409bbf-e6e4-48e5-bb87-f44e9657f122", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "e2e" }, "creationTimestamp": "2026-08-14T17:56:43Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-08-14T17:57:15Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-vjzy", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-vjzy-d499148-rg72n", "release.appstudio.openshift.io/namespace": "final-finalizer-dev-b835", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "simple-pipeline", "tekton.dev/pipelineRun": "managed-krcnj", "tekton.dev/pipelineRunUID": "3c409bbf-e6e4-48e5-bb87-f44e9657f122", "tekton.dev/pipelineTask": "hello-world" }, "name": "managed-krcnj-hello-world", "namespace": "final-finalizer-managed-success", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-krcnj", "uid": "3c409bbf-e6e4-48e5-bb87-f44e9657f122" } ], "resourceVersion": "11752", "uid": "3132e54e-0087-4e5d-8293-52ab45c27b78" }, "spec": { "params": [ { "name": "MESSAGE", "value": "hello world" } ], "serviceAccountName": "release-service-account", "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho $(params.MESSAGE) \n" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-14T17:56:57Z", "conditions": [ { "lastTransitionTime": "2026-08-14T17:56:57Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-krcnj-hello-world-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-08-14T17:56:43Z", "steps": [ { "container": "step-echo-message", "imageID": "registry.access.redhat.com/ubi9/ubi@sha256:9460515b85f2a75278f2043438583c1c377c44bf100178bb653a6c8658304ac7", "name": "echo-message", "provenance": {}, "terminated": { "containerID": "containerd://646b2f058eb128d47620094417c0da325d9e323e733af7a498a3a7c7d242338e", "exitCode": 0, "finishedAt": "2026-08-14T17:56:54Z", "reason": "Completed", "startedAt": "2026-08-14T17:56:54Z" }, "terminationReason": "Completed" } ], "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho hello world \n" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "happy-path-ok7f/snapshot-sample-4zbv-d499148-bhj4r", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "happy-path-managed/results/085b943d-59cd-404d-8e55-5f80a1a66c7c/records/6eb4a64c-3797-4861-a5da-ff50dbed353f", "results.tekton.dev/result": "happy-path-managed/results/085b943d-59cd-404d-8e55-5f80a1a66c7c", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-14T17:55:04Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-08-14T17:56:40Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-4zbv", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-4zbv-d499148-bhj4r", "release.appstudio.openshift.io/namespace": "happy-path-ok7f", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "e2e", "tekton.dev/pipelineRun": "managed-hb8fm", "tekton.dev/pipelineRunUID": "085b943d-59cd-404d-8e55-5f80a1a66c7c", "tekton.dev/pipelineTask": "collect-signing-params", "tekton.dev/task": "collect-signing-params" }, "name": "managed-hb8fm-collect-signing-params", "namespace": "happy-path-managed", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-hb8fm", "uid": "085b943d-59cd-404d-8e55-5f80a1a66c7c" } ], "resourceVersion": "10858", "uid": "6eb4a64c-3797-4861-a5da-ff50dbed353f" }, "spec": { "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/collect-signing-params/collect-signing-params.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-14T17:55:41Z", "conditions": [ { "lastTransitionTime": "2026-08-14T17:55:41Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-hb8fm-collect-signing-params-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "bf86f40dcc69fe741fe23a37abec27d208c934b4" }, "entryPoint": "tasks/managed/collect-signing-params/collect-signing-params.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "buildIdentityRegexp", "type": "string", "value": "" }, { "name": "defaultOIDCIssuer", "type": "string", "value": "" }, { "name": "enableKeylessSigning", "type": "string", "value": "" }, { "name": "fulcioExternalUrl", "type": "string", "value": "" }, { "name": "fulcioUrl", "type": "string", "value": "" }, { "name": "rekorExternalUrl", "type": "string", "value": "" }, { "name": "rekorUrl", "type": "string", "value": "" }, { "name": "tektonChainsIdentity", "type": "string", "value": "" }, { "name": "tufExternalUrl", "type": "string", "value": "" }, { "name": "tufUrl", "type": "string", "value": "" } ], "startTime": "2026-08-14T17:55:04Z", "steps": [ { "container": "step-collect-signing-params", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-signing-params", "provenance": {}, "terminated": { "containerID": "containerd://58289759ea81ebad08d13853d16bb112f578519cbd9bcb79e494f516007a7a2e", "exitCode": 0, "finishedAt": "2026-08-14T17:55:38Z", "message": "[{\"key\":\"buildIdentityRegexp\",\"value\":\"\",\"type\":1},{\"key\":\"defaultOIDCIssuer\",\"value\":\"\",\"type\":1},{\"key\":\"enableKeylessSigning\",\"value\":\"\",\"type\":1},{\"key\":\"fulcioExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"fulcioUrl\",\"value\":\"\",\"type\":1},{\"key\":\"rekorExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"rekorUrl\",\"value\":\"\",\"type\":1},{\"key\":\"tektonChainsIdentity\",\"value\":\"\",\"type\":1},{\"key\":\"tufExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"tufUrl\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-14T17:55:31Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task to collect Konflux configuration parameters related to\nkeyless signing using cosign. The task attempts to read the \"cluster-config\"\nConfigMap in the \"konflux-info\" namespace to extract signing parameters.\n\nIn case the ConfigMap is not found, the task will output empty strings for all parameters,\nallowing the pipeline to continue without signing parameters.", "params": [ { "default": "cluster-config", "description": "The name of the ConfigMap to read signing parameters from", "name": "configMapName", "type": "string" }, { "default": "konflux-info", "description": "The namespace where the ConfigMap is located", "name": "configMapNamespace", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "A flag indicating whether keyless signing should be enabled, based on the presence of signing parameters.\n", "name": "enableKeylessSigning", "type": "string" }, { "description": "A default OIDC issuer URL to be used for signing.\n", "name": "defaultOIDCIssuer", "type": "string" }, { "description": "The external URL of the Rekor transparency log.\n", "name": "rekorExternalUrl", "type": "string" }, { "description": "The internal URL of the Rekor transparency log.\n", "name": "rekorUrl", "type": "string" }, { "description": "The external URL of the Fulcio certificate authority.\n", "name": "fulcioExternalUrl", "type": "string" }, { "description": "The URL of the Fulcio certificate authority.\n", "name": "fulcioUrl", "type": "string" }, { "description": "The external URL of the TUF repository.\n", "name": "tufExternalUrl", "type": "string" }, { "description": "The URL of the TUF repository.\n", "name": "tufUrl", "type": "string" }, { "description": "A regular expression to extract build identity from the OIDC token claims, if applicable.\n", "name": "buildIdentityRegexp", "type": "string" }, { "description": "The identity used in the certificate, generated by fulcio.\n", "name": "tektonChainsIdentity", "type": "string" } ], "stepTemplate": { "computeResources": {}, "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "50m", "memory": "128Mi" }, "requests": { "cpu": "50m", "memory": "128Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-signing-params", "script": "#!/usr/bin/env bash\necho \"Getting cluster-config ConfigMap\"\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\n\n# Attempt to fetch the ConfigMap with retries, capture exit code\nif retry 3 kubectl get configmap \"cluster-config\" -n \"konflux-info\" -o json \u003e \\\n\"$KFLX_CONFIG_PATH\" 2\u003e/dev/null; then\n echo \"ConfigMap found, extracting signing parameters\"\n\n # Extract signing parameters from ConfigMap data, defaulting to empty string if not found\n enableKeylessSigning=$(jq -r '.data.enableKeylessSigning // \"\"' \"$KFLX_CONFIG_PATH\")\n defaultOIDCIssuer=$(jq -r '.data.defaultOIDCIssuer // \"\"' \"$KFLX_CONFIG_PATH\")\n rekorExternalUrl=$(jq -r '.data.rekorExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n rekorInternalUrl=$(jq -r '.data.rekorInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n fulcioExternalUrl=$(jq -r '.data.fulcioExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n fulcioInternalUrl=$(jq -r '.data.fulcioInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n tufExternalUrl=$(jq -r '.data.tufExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n tufInternalUrl=$(jq -r '.data.tufInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n buildIdentityRegexp=$(jq -r '.data.buildIdentityRegexp // \"\"' \"$KFLX_CONFIG_PATH\")\n tektonChainsIdentity=$(jq -r '.data.tektonChainsIdentity // \"\"' \"$KFLX_CONFIG_PATH\")\nelse\n echo \"ConfigMap not found, using default empty values\"\n\n # Set all parameters to empty strings when ConfigMap doesn't exist\n enableKeylessSigning=\"false\"\n defaultOIDCIssuer=\"\"\n rekorExternalUrl=\"\"\n rekorInternalUrl=\"\"\n fulcioExternalUrl=\"\"\n fulcioInternalUrl=\"\"\n tufExternalUrl=\"\"\n tufInternalUrl=\"\"\n buildIdentityRegexp=\"\"\n tektonChainsIdentity=\"\"\nfi\n\n# Write the values to the respective result paths and print them\necho -n \"$enableKeylessSigning\" | tee \"/tekton/results/enableKeylessSigning\"\necho -n \"$defaultOIDCIssuer\" | tee \"/tekton/results/defaultOIDCIssuer\"\necho -n \"$rekorExternalUrl\" | tee \"/tekton/results/rekorExternalUrl\"\nprefer_internal_or_external() {\n local internal=\"$1\"\n local external=\"$2\"\n local result_path=\"$3\"\n\n if [ -n \"$internal\" ]; then\n echo -n \"$internal\" | tee \"$result_path\"\n else\n echo -n \"$external\" | tee \"$result_path\"\n fi\n}\n\nprefer_internal_or_external \"$rekorInternalUrl\" \"$rekorExternalUrl\" \"/tekton/results/rekorUrl\"\necho -n \"$fulcioExternalUrl\" | tee \"/tekton/results/fulcioExternalUrl\"\nprefer_internal_or_external \"$fulcioInternalUrl\" \"$fulcioExternalUrl\" \"/tekton/results/fulcioUrl\"\necho -n \"$tufExternalUrl\" | tee \"/tekton/results/tufExternalUrl\"\nprefer_internal_or_external \"$tufInternalUrl\" \"$tufExternalUrl\" \"/tekton/results/tufUrl\"\necho -n \"$buildIdentityRegexp\" | tee \"/tekton/results/buildIdentityRegexp\"\necho -n \"$tektonChainsIdentity\" | tee \"/tekton/results/tektonChainsIdentity\"\n" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "happy-path-ok7f/snapshot-sample-4zbv-d499148-bhj4r", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "happy-path-managed/results/085b943d-59cd-404d-8e55-5f80a1a66c7c/records/231f7efe-a70a-4917-b00f-5ea65cffd950", "results.tekton.dev/result": "happy-path-managed/results/085b943d-59cd-404d-8e55-5f80a1a66c7c", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Conforma in Konflux", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-14T17:55:41Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-08-14T17:56:40Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-4zbv", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-4zbv-d499148-bhj4r", "release.appstudio.openshift.io/namespace": "happy-path-ok7f", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "e2e", "tekton.dev/pipelineRun": "managed-hb8fm", "tekton.dev/pipelineRunUID": "085b943d-59cd-404d-8e55-5f80a1a66c7c", "tekton.dev/pipelineTask": "verify-conforma", "tekton.dev/task": "verify-conforma-konflux-ta" }, "name": "managed-hb8fm-verify-conforma", "namespace": "happy-path-managed", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-hb8fm", "uid": "085b943d-59cd-404d-8e55-5f80a1a66c7c" } ], "resourceVersion": "10863", "uid": "231f7efe-a70a-4917-b00f-5ea65cffd950" }, "spec": { "params": [ { "name": "SNAPSHOT_FILENAME", "value": "085b943d-59cd-404d-8e55-5f80a1a66c7c/snapshot_spec.json" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:konflux@sha256:6eb386faaf76de0d7dbc9f9e770a7f5639ebcee88e4ed4f004f8053189b21eae\"],\"data\":[\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest@sha256:7612aa06e24e5d8d304e97fd2bde931a6f052f0c1761b766cbcdb20f076c0502\",\"github.com/release-engineering/rhtap-ec-policy.git//data?ref=acaef210b5ddca7a87854b5141556c30efdc2afc\"],\"config\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"include\":[\"@slsa3\"]}}],\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "STRICT", "value": "true" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "EXTRA_RULE_DATA", "value": "pipeline_intention=release" }, { "name": "SOURCE_DATA_ARTIFACT", "value": "oci:quay.io/konflux-ci/release-service-trusted-artifacts@sha256:6dbca3efc214e6d26fcbc775a9a99809acfb17417f1477d187fa16f0cb11c4ca" }, { "name": "TRUSTED_ARTIFACTS_DEBUG", "value": "" }, { "name": "CERTIFICATE_IDENTITY", "value": "" }, { "name": "CERTIFICATE_OIDC_ISSUER", "value": "" }, { "name": "TUF_MIRROR", "value": "" }, { "name": "REKOR_HOST", "value": "" } ], "retries": 2, "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/conforma/tekton-catalog" }, { "name": "revision", "value": "38002d483c4b405e78806ed2d8c9f4c01e91e429" }, { "name": "pathInRepo", "value": "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml" } ], "resolver": "git" }, "timeout": "4h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-14T17:56:24Z", "conditions": [ { "lastTransitionTime": "2026-08-14T17:56:24Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-hb8fm-verify-conforma-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "38002d483c4b405e78806ed2d8c9f4c01e91e429" }, "entryPoint": "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml", "uri": "git+https://github.com/conforma/tekton-catalog" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1786730182\",\"namespace\":\"\",\"successes\":22,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n" }, { "name": "VSA_GENERATED", "type": "string", "value": "false" } ], "startTime": "2026-08-14T17:55:42Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://66cb457be270a2677ec55cda77a027ec726983ab69e290b6747f37e818b771c4", "exitCode": 0, "finishedAt": "2026-08-14T17:56:04Z", "reason": "Completed", "startedAt": "2026-08-14T17:56:00Z" }, "terminationReason": "Completed" }, { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "containerd://4b2e7da9115e5a13fb2c788cf2ccdd4b9f3834074f65776f929d49b07ee263e0", "exitCode": 0, "finishedAt": "2026-08-14T17:56:04Z", "reason": "Completed", "startedAt": "2026-08-14T17:56:04Z" }, "terminationReason": "Completed" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "name": "reduce", "provenance": {}, "terminated": { "containerID": "containerd://9faa474abb19b7628f7795ef65121c3f532f6b3270f36cf54f4cfc5ccf1dded4", "exitCode": 0, "finishedAt": "2026-08-14T17:56:05Z", "reason": "Completed", "startedAt": "2026-08-14T17:56:05Z" }, "terminationReason": "Completed" }, { "container": "step-pin-policy-bundle", "imageID": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "name": "pin-policy-bundle", "provenance": {}, "terminated": { "containerID": "containerd://aed03ba7fcd2e55e52d7400e2b95f1aeb892dac2ad36403dae8d025e68cce966", "exitCode": 0, "finishedAt": "2026-08-14T17:56:05Z", "reason": "Completed", "startedAt": "2026-08-14T17:56:05Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "name": "validate", "provenance": {}, "terminated": { "containerID": "containerd://26ce954a72eb62496e0838a83bd07dec5d008c7203d3909df5104a50b972711f", "exitCode": 0, "finishedAt": "2026-08-14T17:56:22Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786730182\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-14T17:56:05Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "name": "report-json", "provenance": {}, "terminated": { "containerID": "containerd://150350b804b2cffa31b1464ea4b75afb2e0c9f1e9cf44aea6957566193fd54cb", "exitCode": 0, "finishedAt": "2026-08-14T17:56:22Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786730182\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-14T17:56:22Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "name": "summary", "provenance": {}, "terminated": { "containerID": "containerd://81a3bcec7fd7b244972826593b287b006301928cbca51dac3549fd0b84ad5d86", "exitCode": 0, "finishedAt": "2026-08-14T17:56:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786730182\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-14T17:56:23Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "name": "version", "provenance": {}, "terminated": { "containerID": "containerd://39039dc77f144adfaa79d4ee0926a03933c75986324fa5733a565d0061ae8b05", "exitCode": 0, "finishedAt": "2026-08-14T17:56:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786730182\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-14T17:56:23Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "name": "show-config", "provenance": {}, "terminated": { "containerID": "containerd://2d0d0fd28249bd6d06f4ea15b3c1055d6e73d4545cd8965569b690f69fcc419a", "exitCode": 0, "finishedAt": "2026-08-14T17:56:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786730182\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-14T17:56:23Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "containerd://6ca863be0023599402fef811f90aad67f941ac7273051d104416303de38f3bc5", "exitCode": 0, "finishedAt": "2026-08-14T17:56:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786730182\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-14T17:56:23Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "name": "assert", "provenance": {}, "terminated": { "containerID": "containerd://9266491662c91957cc09d8c7c8e209abd35157325bc6a98fab2ef4ea91a948e7", "exitCode": 0, "finishedAt": "2026-08-14T17:56:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786730182\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-14T17:56:24Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://1dc018f036ee3859964eb207d5aa8f719249a35cf9329a219047f687627ff646", "exitCode": 0, "finishedAt": "2026-08-14T17:56:24Z", "reason": "Completed", "startedAt": "2026-08-14T17:56:24Z" }, "terminationReason": "Skipped" } ], "taskSpec": { "description": "Verify the Conforma policy is met", "params": [ { "description": "The filename of the `Snapshot` that is located within the trusted artifact\n", "name": "SNAPSHOT_FILENAME", "type": "string" }, { "description": "Trusted Artifact to use to obtain the Snapshot to validate.\n", "name": "SOURCE_DATA_ARTIFACT", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "false", "description": "Allow setting EFFECTIVE_TIME to a date in the past.", "name": "ALLOW_PAST_EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "sha256:ee5c3a020c9545eca738ed87198af0b235463069b2d72c5dba609364a83321d2", "description": "Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@\u003cdigest\u003e. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...).", "name": "POLICY_BUNDLE_DIGEST", "type": "string" }, { "default": "4", "description": "Number of parallel workers to use for policy evaluation.\n", "name": "WORKERS", "type": "string" }, { "default": "", "description": "Use the OPA evaluator instead of the default conftest evaluator. Set to \"1\" to enable.", "name": "EC_USE_OPA", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "ORAS_OPTIONS", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable.", "name": "TRUSTED_ARTIFACTS_DEBUG", "type": "string" }, { "default": "/var/workdir/conforma", "description": "Directory to use to extract trusted artifact archive.", "name": "TRUSTED_ARTIFACTS_EXTRACT_DIR", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" }, { "default": "false", "description": "Enable VSA generation", "name": "ENABLE_VSA", "type": "string" }, { "default": "dsse", "description": "Attestation format: dsse (signed envelope) or predicate (raw JSON)", "name": "ATTESTATION_FORMAT", "type": "string" }, { "default": "", "description": "Signing key for format=dsse (k8s:// or file:// URL)", "name": "VSA_SIGNING_KEY", "type": "string" }, { "default": "local@/var/workdir/conforma/vsa", "description": "VSA upload destination", "name": "VSA_UPLOAD", "type": "string" }, { "default": "", "description": "OCI storage URL for trusted artifacts", "name": "ociStorage", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Whether VSAs were generated (true/false)", "name": "VSA_GENERATED", "type": "string" }, { "description": "Trusted Artifact URI containing VSA files", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" }, { "name": "HOME", "value": "/tekton/home" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay.io/konflux-ci/release-service-trusted-artifacts@sha256:6dbca3efc214e6d26fcbc775a9a99809acfb17417f1477d187fa16f0cb11c4ca=/var/workdir/conforma" ], "computeResources": {}, "env": [ { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": {}, "env": [ { "name": "TUF_MIRROR" } ], "image": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "imagePullPolicy": "IfNotPresent", "name": "initialize-tuf", "script": "set -euo pipefail\n\nif [[ -z \"${TUF_MIRROR:-}\" ]]; then\n echo 'TUF_MIRROR parameter not provided. Skipping TUF root initialization.'\n exit\nfi\n\necho 'Initializing TUF root...'\nec sigstore initialize --mirror \"${TUF_MIRROR}\" --root \"${TUF_MIRROR}/root.json\"\necho 'Done!'" }, { "command": [ "reduce-snapshot.sh" ], "computeResources": {}, "env": [ { "name": "SNAPSHOT", "value": "/var/workdir/conforma/085b943d-59cd-404d-8e55-5f80a1a66c7c/snapshot_spec.json" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "imagePullPolicy": "IfNotPresent", "name": "reduce", "onError": "continue" }, { "command": [ "pin-konflux-policy-bundle.sh" ], "computeResources": {}, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:konflux@sha256:6eb386faaf76de0d7dbc9f9e770a7f5639ebcee88e4ed4f004f8053189b21eae\"],\"data\":[\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest@sha256:7612aa06e24e5d8d304e97fd2bde931a6f052f0c1761b766cbcdb20f076c0502\",\"github.com/release-engineering/rhtap-ec-policy.git//data?ref=acaef210b5ddca7a87854b5141556c30efdc2afc\"],\"config\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"include\":[\"@slsa3\"]}}],\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "POLICY_BUNDLE_DIGEST", "value": "sha256:ee5c3a020c9545eca738ed87198af0b235463069b2d72c5dba609364a83321d2" } ], "image": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "imagePullPolicy": "IfNotPresent", "name": "pin-policy-bundle", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "250m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:konflux@sha256:6eb386faaf76de0d7dbc9f9e770a7f5639ebcee88e4ed4f004f8053189b21eae\"],\"data\":[\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest@sha256:7612aa06e24e5d8d304e97fd2bde931a6f052f0c1761b766cbcdb20f076c0502\",\"github.com/release-engineering/rhtap-ec-policy.git//data?ref=acaef210b5ddca7a87854b5141556c30efdc2afc\"],\"config\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"include\":[\"@slsa3\"]}}],\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "PUBLIC_KEY" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "4" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "ALLOW_PAST_EFFECTIVE_TIME", "value": "false" }, { "name": "EXTRA_RULE_DATA", "value": "pipeline_intention=release" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "ENABLE_VSA", "value": "false" }, { "name": "ATTESTATION_FORMAT", "value": "dsse" }, { "name": "VSA_SIGNING_KEY" }, { "name": "VSA_UPLOAD", "value": "local@/var/workdir/conforma/vsa" }, { "name": "EC_USE_OPA" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "imagePullPolicy": "IfNotPresent", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\n# Use policy override file if pin-policy-bundle produced one\nif [[ -f \"${HOMEDIR}/policy-with-pinned-bundle.yaml\" ]]; then\n POLICY_CONFIGURATION=\"${HOMEDIR}/policy-with-pinned-bundle.yaml\"\nfi\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --allow-past-effective-time=\"${ALLOW_PAST_EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n# Add VSA arguments if enabled\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n cmd_args+=(\n --vsa=\"true\"\n --attestation-format=\"${ATTESTATION_FORMAT}\"\n )\n\n\n if [[ \"${ATTESTATION_FORMAT}\" == \"dsse\" ]]; then\n if [[ -z \"${VSA_SIGNING_KEY}\" ]]; then\n echo \"ERROR: VSA_SIGNING_KEY required for format=dsse\" \u003e\u00262\n exit 1\n fi\n cmd_args+=(\n --vsa-signing-key=\"${VSA_SIGNING_KEY}\"\n --vsa-upload=\"${VSA_UPLOAD}\"\n )\n fi\n\n # ec requires --attestation-output-dir to be under /tmp or cwd.\n # Write there first, then copy to the workdir so\n # create-trusted-artifact includes them in the archive.\n VSA_TMP_DIR=\"/tmp/vsa-output\"\n mkdir -p \"$VSA_TMP_DIR\"\n cmd_args+=(\n --attestation-output-dir=\"$VSA_TMP_DIR\"\n )\n\n echo -n \"true\" \u003e /tekton/results/VSA_GENERATED\nelse\n echo -n \"false\" \u003e /tekton/results/VSA_GENERATED\nfi\n\n# Execute Conforma with constructed arguments\nec \"${cmd_args[@]}\"\n\n# Copy VSA output from /tmp to workdir for trusted artifact archival\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n # Extract local path from VSA_UPLOAD for output directory\n # VSA_UPLOAD format is \"local@/path/to/dir\"\n # Fixme: Because of -o pipefail this will fail the whole task when the grep doesn't match\n VSA_LOCAL_PATH=$(echo \"${VSA_UPLOAD}\" | grep -oE '^local@[^ ]+' | sed 's/^local@//' | head -n1 || true)\n if [[ -n \"$VSA_LOCAL_PATH\" \u0026\u0026 -d \"/tmp/vsa-output\" ]]; then\n mkdir -p \"$VSA_LOCAL_PATH\"\n cp -r /tmp/vsa-output/* \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n # Include raw JSON report for downstream SLSA VSA generation\n cp \"${HOMEDIR}/report-json.json\" \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n fi\nfi\n" }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "imagePullPolicy": "IfNotPresent", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "imagePullPolicy": "IfNotPresent", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "imagePullPolicy": "IfNotPresent", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "imagePullPolicy": "IfNotPresent", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "imagePullPolicy": "IfNotPresent", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:b87bab27cdbb6abdc9e41106629a5ae8c5d04c1e2d859d67bc4fc76c5f7f277a", "imagePullPolicy": "IfNotPresent", "name": "assert" }, { "args": [ "create", "--store", "", "/tekton/results/sourceDataArtifact=/var/workdir/conforma" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "when": [ { "input": "false", "operator": "in", "values": [ "true" ] }, { "operator": "notin", "values": [ "", "empty" ] } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "tenant-dev-f2di/snapshot-sample-zq22-d499148-j659x", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "tenant-dev-f2di/results/2894677f-b868-4991-9c08-d1b67e81d1f7/records/eb46d25b-bf3e-4a65-b0d4-f3270efa9706", "results.tekton.dev/result": "tenant-dev-f2di/results/2894677f-b868-4991-9c08-d1b67e81d1f7", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "e2e" }, "creationTimestamp": "2026-08-14T17:57:13Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-08-14T17:57:27Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-zq22", "pipelines.appstudio.openshift.io/type": "tenant", "release.appstudio.openshift.io/name": "snapshot-sample-zq22-d499148-j659x", "release.appstudio.openshift.io/namespace": "tenant-dev-f2di", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "simple-pipeline", "tekton.dev/pipelineRun": "tenant-6ppdh", "tekton.dev/pipelineRunUID": "2894677f-b868-4991-9c08-d1b67e81d1f7", "tekton.dev/pipelineTask": "hello-world" }, "name": "tenant-6ppdh-hello-world", "namespace": "tenant-dev-f2di", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "tenant-6ppdh", "uid": "2894677f-b868-4991-9c08-d1b67e81d1f7" } ], "resourceVersion": "12253", "uid": "eb46d25b-bf3e-4a65-b0d4-f3270efa9706" }, "spec": { "params": [ { "name": "MESSAGE", "value": "hello world" } ], "serviceAccountName": "tenant-service-account", "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho $(params.MESSAGE) \n" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-14T17:57:19Z", "conditions": [ { "lastTransitionTime": "2026-08-14T17:57:19Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "tenant-6ppdh-hello-world-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-08-14T17:57:13Z", "steps": [ { "container": "step-echo-message", "imageID": "registry.access.redhat.com/ubi9/ubi@sha256:9460515b85f2a75278f2043438583c1c377c44bf100178bb653a6c8658304ac7", "name": "echo-message", "provenance": {}, "terminated": { "containerID": "containerd://c71677fd8e44a93f9c0c04e82580c785f03de6e5c88771674bcbf6976d97ecdc", "exitCode": 0, "finishedAt": "2026-08-14T17:57:18Z", "reason": "Completed", "startedAt": "2026-08-14T17:57:18Z" }, "terminationReason": "Completed" } ], "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho hello world \n" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }