{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "PipelineRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "chains.tekton.dev/transparency": "http://rekor-server.tsf-tas.svc.cluster.local/api/v1/log/entries?logIndex=58", "operator-sdk/primary-resource": "default-tenant/tsf-demo-app-20260424-074235-000-5f08385-kw82m", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/branch": "base-ebyreq", "pac.test.appstudio.openshift.io/cancel-in-progress": "false", "pac.test.appstudio.openshift.io/check-run-id": "72839962704", "pac.test.appstudio.openshift.io/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pac.test.appstudio.openshift.io/event-type": "push", "pac.test.appstudio.openshift.io/git-auth-secret": "pac-gitauth-mgrieh", "pac.test.appstudio.openshift.io/git-provider": "github", "pac.test.appstudio.openshift.io/installation-id": "112348674", "pac.test.appstudio.openshift.io/log-url": "https://konflux-ui-konflux-ui.apps.rosa.kx-57b70f2209.qns6.p3.openshiftapps.com/ns/default-tenant/pipelinerun/tsf-demo-comp-on-push-mclph", "pac.test.appstudio.openshift.io/max-keep-runs": "3", "pac.test.appstudio.openshift.io/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-ebyreq\"", "pac.test.appstudio.openshift.io/original-prname": "tsf-demo-comp-on-push", "pac.test.appstudio.openshift.io/repo-url": "https://github.com/rhads-tsf-qe/testrepo", "pac.test.appstudio.openshift.io/repository": "tsf-demo-comp", "pac.test.appstudio.openshift.io/scm-reporting-plr-started": "true", "pac.test.appstudio.openshift.io/sender": "rhtap-ci-tests-bot", "pac.test.appstudio.openshift.io/sha": "5f0838507251d833df91ef169fe5c63e3c62ea0f", "pac.test.appstudio.openshift.io/sha-title": "Merge pull request #219 from rhads-tsf-qe/konflux-tsf-demo-comp", "pac.test.appstudio.openshift.io/sha-url": "https://github.com/rhads-tsf-qe/testrepo/commit/5f0838507251d833df91ef169fe5c63e3c62ea0f", "pac.test.appstudio.openshift.io/source-branch": "refs/heads/base-ebyreq", "pac.test.appstudio.openshift.io/source-repo-url": "https://github.com/rhads-tsf-qe/testrepo", "pac.test.appstudio.openshift.io/state": "completed", "pac.test.appstudio.openshift.io/url-org": "rhads-tsf-qe", "pac.test.appstudio.openshift.io/url-repository": "testrepo", "results.tekton.dev/record": "default-managed-tenant-flll7/results/3fe7d07e-e509-471b-bc44-2ff3722fccab/records/3fe7d07e-e509-471b-bc44-2ff3722fccab", "results.tekton.dev/result": "default-managed-tenant-flll7/results/3fe7d07e-e509-471b-bc44-2ff3722fccab", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-04-24T07:51:56Z", "finalizers": [ "chains.tekton.dev/pipelinerun", "results.tekton.dev/pipelinerun" ], "generateName": "managed-", "generation": 1, "labels": { "appstudio.openshift.io/application": "tsf-demo-app", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "tsf-demo-app-20260424-074235-000", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/name": "tsf-demo-app-20260424-074235-000-5f08385-kw82m", "release.appstudio.openshift.io/namespace": "default-tenant", "tekton.dev/pipeline": "push-to-external-registry" }, "name": "managed-g9njc", "namespace": "default-managed-tenant-flll7", "resourceVersion": "50266", "uid": "3fe7d07e-e509-471b-bc44-2ff3722fccab" }, "spec": { "params": [ { "name": "release", "value": "default-tenant/tsf-demo-app-20260424-074235-000-5f08385-kw82m" }, { "name": "releasePlan", "value": "default-tenant/tsf-release" }, { "name": "releasePlanAdmission", "value": "default-managed-tenant-flll7/tsf-release" }, { "name": "releaseServiceConfig", "value": "release-service/release-service-config" }, { "name": "snapshot", "value": "default-tenant/tsf-demo-app-20260424-074235-000" }, { "name": "enterpriseContractPolicy", "value": "{\"name\":\"Default\",\"description\":\"Includes most of the rules and policies required internally by Red Hat when building Red Hat products. It excludes the requirement of hermetic builds. Available collections are defined in https://redhat-appstudio.github.io/docs.stonesoup.io/ec-policies/release_policy.html#_available_rule_collections. If a different policy configuration is desired, this resource can serve as a starting point. See the docs on how to include and exclude rules https://redhat-appstudio.github.io/docs.stonesoup.io/ec-policies/policy_configuration.html#_including_and_excluding_rules.\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:konflux@sha256:1b296a925b4021f4b4959ea289596925a8735540e554f3ba7754a651731a216f\"],\"data\":[\"github.com/konflux-ci/konflux-operator-trusted-sources//data?ref=95b1ba6bd85fa2117c544f4adb446f9b74a870e3\",\"github.com/redhat-appstudio/tsf-conforma-data//data?ref=1966f21842d507441a7a5e1c7de9071cf3f9ec53\"],\"config\":{\"exclude\":[\"hermetic_task\",\"source_image\",\"rpm_repos\"],\"include\":[\"@redhat\"]}}],\"publicKey\":\"k8s://openshift-pipelines/public-key\"}" }, { "name": "verify_ec_task_bundle", "value": "quay.io/enterprise-contract/ec-task-bundle@sha256:4b657f5bf6144625093a5a58eeb3352816f5bf4196a53a915b4f109764460cc8" }, { "name": "verify_ec_task_git_revision", "value": "b1ede77ff694522a917dea2b4bde14b2cc1839f2" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" } ], "pipelineRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "pipelines/managed/push-to-external-registry/push-to-external-registry.yaml" } ], "resolver": "git" }, "taskRunSpecs": [ { "pipelineTaskName": "push-snapshot", "stepSpecs": [ { "computeResources": { "limits": { "memory": "1Gi" }, "requests": { "cpu": "10m", "memory": "256Mi" } }, "name": "push-snapshot" } ] } ], "taskRunTemplate": { "serviceAccountName": "release-pipeline" }, "timeouts": { "pipeline": "1h0m0s" }, "workspaces": [ { "name": "release-workspace", "volumeClaimTemplate": { "metadata": { "creationTimestamp": null }, "spec": { "accessModes": [ "ReadWriteOnce" ], "resources": { "requests": { "storage": "1Gi" } } }, "status": {} } } ] }, "status": { "childReferences": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-verify-access-to-resources", "pipelineTaskName": "verify-access-to-resources" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-collect-data", "pipelineTaskName": "collect-data" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-collect-task-params", "pipelineTaskName": "collect-task-params" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-check-data-keys", "pipelineTaskName": "check-data-keys" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-collect-signing-params", "pipelineTaskName": "collect-signing-params" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-reduce-snapshot", "pipelineTaskName": "reduce-snapshot" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-apply-mapping", "pipelineTaskName": "apply-mapping" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-filter-already-released-images", "pipelineTaskName": "filter-already-released-images" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-verify-conforma", "pipelineTaskName": "verify-conforma", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-push-snapshot", "pipelineTaskName": "push-snapshot", "whenExpressions": [ { "input": "true", "operator": "in", "values": [ "true" ] }, { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-sign-image-cosign-keyless", "pipelineTaskName": "sign-image-cosign-keyless", "whenExpressions": [ { "input": "true", "operator": "in", "values": [ "true", "True", "TRUE" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-collect-registry-token-secret", "pipelineTaskName": "collect-registry-token-secret" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-collect-tpa-params", "pipelineTaskName": "collect-tpa-params", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "managed-g9njc-process-component-sbom", "pipelineTaskName": "process-component-sbom", "whenExpressions": [ { "input": "https://server-tsf-tpa.apps.rosa.kx-57b70f2209.qns6.p3.openshiftapps.com", "operator": "notin", "values": [ "" ] } ] } ], "completionTime": "2026-04-24T07:55:23Z", "conditions": [ { "lastTransitionTime": "2026-04-24T07:55:23Z", "message": "Tasks Completed: 14 (Failed: 1, Cancelled 0), Skipped: 2", "reason": "Failed", "status": "False", "type": "Succeeded" } ], "pipelineSpec": { "description": "Tekton pipeline to release Snapshots to an external registry.", "params": [ { "description": "The namespaced name (namespace/name) of the Release custom resource initiating this pipeline execution", "name": "release", "type": "string" }, { "description": "The namespaced name (namespace/name) of the releasePlan", "name": "releasePlan", "type": "string" }, { "description": "The namespaced name (namespace/name) of the releasePlanAdmission", "name": "releasePlanAdmission", "type": "string" }, { "description": "The namespaced name (namespace/name) of the releaseServiceConfig", "name": "releaseServiceConfig", "type": "string" }, { "description": "The namespaced name (namespace/name) of the snapshot", "name": "snapshot", "type": "string" }, { "description": "JSON representation of the EnterpriseContractPolicy", "name": "enterpriseContractPolicy", "type": "string" }, { "default": "pipeline_intention=release", "description": "Extra rule data to be merged into the policy specified in params.enterpriseContractPolicy. Use syntax\n\"key1=value1,key2=value2...\"\n", "name": "enterpriseContractExtraRuleData", "type": "string" }, { "description": "The git revision to be used when consuming the verify-conforma task", "name": "verify_ec_task_git_revision", "type": "string" }, { "default": "https://github.com/konflux-ci/release-service-catalog.git", "description": "The url to the git repo where the release-service-catalog tasks to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "quay.io/konflux-ci/release-service-trusted-artifacts", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "default": "fb3aaa43fb938f05c3f175a7e4c699da63c5f34b", "description": "The git revision to be used when consuming Mobster tasks for SBOM processing", "name": "mobster_tasks_git_revision", "type": "string" }, { "default": "k8s://openshift-pipelines/public-key", "description": "Path to the key used by Conforma to verify attestations signed by it", "name": "conformaPubKey", "type": "string" } ], "tasks": [ { "name": "verify-access-to-resources", "params": [ { "name": "release", "value": "default-tenant/tsf-demo-app-20260424-074235-000-5f08385-kw82m" }, { "name": "releasePlan", "value": "default-tenant/tsf-release" }, { "name": "releasePlanAdmission", "value": "default-managed-tenant-flll7/tsf-release" }, { "name": "releaseServiceConfig", "value": "release-service/release-service-config" }, { "name": "snapshot", "value": "default-tenant/tsf-demo-app-20260424-074235-000" }, { "name": "requireInternalServices", "value": "false" } ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/verify-access-to-resources/verify-access-to-resources.yaml" } ], "resolver": "git" } }, { "name": "collect-data", "params": [ { "name": "release", "value": "default-tenant/tsf-demo-app-20260424-074235-000-5f08385-kw82m" }, { "name": "releasePlan", "value": "default-tenant/tsf-release" }, { "name": "releasePlanAdmission", "value": "default-managed-tenant-flll7/tsf-release" }, { "name": "releaseServiceConfig", "value": "release-service/release-service-config" }, { "name": "snapshot", "value": "default-tenant/tsf-demo-app-20260424-074235-000" }, { "name": "subdirectory", "value": "3fe7d07e-e509-471b-bc44-2ff3722fccab" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" } ], "runAfter": [ "verify-access-to-resources" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/collect-data/collect-data.yaml" } ], "resolver": "git" } }, { "name": "collect-task-params", "params": [ { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "dataPath", "value": "$(tasks.collect-data.results.data)" }, { "name": "keysToExtract", "value": "[\n {\"resultIndex\": 0, \"key\": \".conforma.workerCount\", \"default\": \"4\"},\n {\"resultIndex\": 1, \"key\": \".sign.cosignSecretName\", \"default\": \"secret-not-present\"}\n]\n" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "$(tasks.collect-data.results.sourceDataArtifact)" }, { "name": "trustedArtifactsDebug", "value": "" } ], "runAfter": [ "collect-data" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/collect-task-params/collect-task-params.yaml" } ], "resolver": "git" } }, { "name": "check-data-keys", "params": [ { "name": "dataPath", "value": "$(tasks.collect-data.results.data)" }, { "name": "schema", "value": "https://github.com/konflux-ci/release-service-catalog.git/raw/development/schema/dataKeys.json" }, { "name": "systems", "value": "[\n {\"systemName\": \"mapping\", \"dynamic\": false}\n]\n" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "$(tasks.collect-data.results.sourceDataArtifact)" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" } ], "runAfter": [ "collect-data" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/check-data-keys/check-data-keys.yaml" } ], "resolver": "git" } }, { "name": "collect-signing-params", "runAfter": [ "collect-data" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/collect-signing-params/collect-signing-params.yaml" } ], "resolver": "git" } }, { "name": "reduce-snapshot", "params": [ { "name": "SNAPSHOT", "value": "/var/workdir/release/$(tasks.collect-data.results.snapshotSpec)" }, { "name": "SINGLE_COMPONENT", "value": "$(tasks.collect-data.results.singleComponentMode)" }, { "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "value": "snapshot/$(tasks.collect-data.results.snapshotName)" }, { "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "value": "$(tasks.collect-data.results.snapshotNamespace)" }, { "name": "SNAPSHOT_PATH", "value": "/var/workdir/release/$(tasks.collect-data.results.snapshotSpec)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "$(tasks.collect-data.results.sourceDataArtifact)" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" } ], "runAfter": [ "collect-data" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/reduce-snapshot/reduce-snapshot.yaml" } ], "resolver": "git" } }, { "name": "apply-mapping", "params": [ { "name": "failOnEmptyResult", "value": "true" }, { "name": "dataPath", "value": "$(tasks.collect-data.results.data)" }, { "name": "snapshotPath", "value": "$(tasks.collect-data.results.snapshotSpec)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "$(tasks.reduce-snapshot.results.sourceDataArtifact)" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" } ], "retries": 3, "runAfter": [ "reduce-snapshot" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/apply-mapping/apply-mapping.yaml" } ], "resolver": "git" } }, { "name": "filter-already-released-images", "params": [ { "name": "snapshotPath", "value": "$(tasks.collect-data.results.snapshotSpec)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "$(tasks.apply-mapping.results.sourceDataArtifact)" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" } ], "runAfter": [ "apply-mapping" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/filter-already-released-images/filter-already-released-images.yaml" } ], "resolver": "git" } }, { "name": "verify-conforma", "params": [ { "name": "SNAPSHOT_FILENAME", "value": "$(tasks.collect-data.results.snapshotSpec)" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "POLICY_CONFIGURATION", "value": "{\"name\":\"Default\",\"description\":\"Includes most of the rules and policies required internally by Red Hat when building Red Hat products. It excludes the requirement of hermetic builds. Available collections are defined in https://redhat-appstudio.github.io/docs.stonesoup.io/ec-policies/release_policy.html#_available_rule_collections. If a different policy configuration is desired, this resource can serve as a starting point. See the docs on how to include and exclude rules https://redhat-appstudio.github.io/docs.stonesoup.io/ec-policies/policy_configuration.html#_including_and_excluding_rules.\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:konflux@sha256:1b296a925b4021f4b4959ea289596925a8735540e554f3ba7754a651731a216f\"],\"data\":[\"github.com/konflux-ci/konflux-operator-trusted-sources//data?ref=95b1ba6bd85fa2117c544f4adb446f9b74a870e3\",\"github.com/redhat-appstudio/tsf-conforma-data//data?ref=1966f21842d507441a7a5e1c7de9071cf3f9ec53\"],\"config\":{\"exclude\":[\"hermetic_task\",\"source_image\",\"rpm_repos\"],\"include\":[\"@redhat\"]}}],\"publicKey\":\"k8s://openshift-pipelines/public-key\"}" }, { "name": "STRICT", "value": "true" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "EXTRA_RULE_DATA", "value": "pipeline_intention=release" }, { "name": "WORKERS", "value": "$(tasks.collect-task-params.results.extractedValues[0])" }, { "name": "SOURCE_DATA_ARTIFACT", "value": "$(tasks.filter-already-released-images.results.sourceDataArtifact)" }, { "name": "TRUSTED_ARTIFACTS_DEBUG", "value": "" }, { "name": "CERTIFICATE_IDENTITY", "value": "$(tasks.collect-signing-params.results.tektonChainsIdentity)" }, { "name": "CERTIFICATE_OIDC_ISSUER", "value": "$(tasks.collect-signing-params.results.defaultOIDCIssuer)" }, { "name": "TUF_MIRROR", "value": "$(tasks.collect-signing-params.results.tufUrl)" }, { "name": "REKOR_HOST", "value": "$(tasks.collect-signing-params.results.rekorUrl)" } ], "runAfter": [ "filter-already-released-images", "collect-task-params", "collect-signing-params" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/conforma/cli" }, { "name": "revision", "value": "b1ede77ff694522a917dea2b4bde14b2cc1839f2" }, { "name": "pathInRepo", "value": "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml" } ], "resolver": "git" }, "timeout": "4h0m0s", "when": [ { "input": "$(tasks.filter-already-released-images.results.skip_release)", "operator": "in", "values": [ "false" ] } ] }, { "name": "push-snapshot", "params": [ { "name": "snapshotPath", "value": "$(tasks.collect-data.results.snapshotSpec)" }, { "name": "dataPath", "value": "$(tasks.collect-data.results.data)" }, { "name": "resultsDirPath", "value": "$(tasks.collect-data.results.resultsDir)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "$(tasks.filter-already-released-images.results.sourceDataArtifact)" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" } ], "retries": 5, "runAfter": [ "verify-conforma" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/push-snapshot/push-snapshot.yaml" } ], "resolver": "git" }, "when": [ { "input": "$(tasks.apply-mapping.results.mapped)", "operator": "in", "values": [ "true" ] }, { "input": "$(tasks.filter-already-released-images.results.skip_release)", "operator": "in", "values": [ "false" ] } ] }, { "name": "sign-image-cosign-keyless", "params": [ { "name": "snapshotPath", "value": "$(tasks.collect-data.results.snapshotSpec)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "$(tasks.apply-mapping.results.sourceDataArtifact)" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" }, { "name": "keylessRekorURL", "value": "$(tasks.collect-signing-params.results.rekorUrl)" }, { "name": "keylessFulcioURL", "value": "$(tasks.collect-signing-params.results.fulcioUrl)" }, { "name": "keylessOIDCIssuer", "value": "$(tasks.collect-signing-params.results.defaultOIDCIssuer)" }, { "name": "keylessTufURL", "value": "$(tasks.collect-signing-params.results.tufUrl)" } ], "runAfter": [ "collect-signing-params", "push-snapshot", "collect-task-params" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/sign-image-cosign-keyless/sign-image-cosign-keyless.yaml" } ], "resolver": "git" }, "timeout": "6h0m0s", "when": [ { "input": "$(tasks.collect-signing-params.results.enableKeylessSigning)", "operator": "in", "values": [ "true", "True", "TRUE" ] } ] }, { "name": "collect-registry-token-secret", "params": [ { "name": "dataPath", "value": "$(tasks.collect-data.results.data)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "$(tasks.collect-data.results.sourceDataArtifact)" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" } ], "runAfter": [ "collect-data" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/collect-registry-token-secret/collect-registry-token-secret.yaml" } ], "resolver": "git" } }, { "name": "make-repo-public", "params": [ { "name": "dataPath", "value": "$(tasks.collect-data.results.data)" }, { "name": "snapshotPath", "value": "$(tasks.collect-data.results.snapshotSpec)" }, { "name": "registrySecret", "value": "$(tasks.collect-registry-token-secret.results.registrySecret)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "$(tasks.push-snapshot.results.sourceDataArtifact)" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" } ], "retries": 5, "runAfter": [ "collect-registry-token-secret", "push-snapshot" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/make-repo-public/make-repo-public.yaml" } ], "resolver": "git" }, "when": [ { "input": "$(tasks.collect-registry-token-secret.results.registrySecret)", "operator": "notin", "values": [ "" ] } ] }, { "name": "collect-tpa-params", "params": [ { "name": "dataPath", "value": "$(tasks.collect-data.results.data)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "$(tasks.collect-data.results.sourceDataArtifact)" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" }, { "name": "failOnMissing", "value": "false" } ], "runAfter": [ "collect-data" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/collect-tpa-params/collect-tpa-params.yaml" } ], "resolver": "git" }, "when": [ { "input": "$(tasks.filter-already-released-images.results.skip_release)", "operator": "in", "values": [ "false" ] } ] }, { "name": "process-component-sbom", "params": [ { "name": "resultsDirPath", "value": "$(tasks.collect-data.results.resultsDir)" }, { "name": "snapshotSpec", "value": "$(tasks.collect-data.results.snapshotSpec)" }, { "name": "releaseData", "value": "$(tasks.collect-data.results.data)" }, { "name": "retryAWSSecretName", "value": "$(tasks.collect-tpa-params.results.retryAWSSecretName)" }, { "name": "retryS3Bucket", "value": "$(tasks.collect-tpa-params.results.retryS3Bucket)" }, { "name": "atlasSecretName", "value": "$(tasks.collect-tpa-params.results.secretName)" }, { "name": "ssoTokenUrl", "value": "$(tasks.collect-tpa-params.results.ssoTokenUrl)" }, { "name": "atlasApiUrl", "value": "$(tasks.collect-tpa-params.results.atlasApiUrl)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "$(tasks.filter-already-released-images.results.sourceDataArtifact)" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" }, { "name": "cosignSecretName", "value": "$(tasks.collect-task-params.results.extractedValues[1])" }, { "name": "attestationPubKey", "value": "k8s://openshift-pipelines/public-key" }, { "name": "defaultOIDCIssuer", "value": "$(tasks.collect-signing-params.results.defaultOIDCIssuer)" }, { "name": "rekorExternalUrl", "value": "$(tasks.collect-signing-params.results.rekorExternalUrl)" }, { "name": "fulcioExternalUrl", "value": "$(tasks.collect-signing-params.results.fulcioExternalUrl)" }, { "name": "tufExternalUrl", "value": "$(tasks.collect-signing-params.results.tufExternalUrl)" }, { "name": "buildIdentityRegexp", "value": "$(tasks.collect-signing-params.results.buildIdentityRegexp)" } ], "runAfter": [ "collect-data", "apply-mapping", "collect-tpa-params", "push-snapshot" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/mobster.git" }, { "name": "revision", "value": "fb3aaa43fb938f05c3f175a7e4c699da63c5f34b" }, { "name": "pathInRepo", "value": "tasks/augment-component-sboms-ta/0.3/augment-component-sboms-ta.yaml" } ], "resolver": "git" }, "when": [ { "input": "$(tasks.collect-tpa-params.results.atlasApiUrl)", "operator": "notin", "values": [ "" ] } ] }, { "name": "update-cr-status", "params": [ { "name": "resource", "value": "default-tenant/tsf-demo-app-20260424-074235-000-5f08385-kw82m" }, { "name": "resultsDirPath", "value": "$(tasks.collect-data.results.resultsDir)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-managed-tenant-flll7/default-managed-tenant-flll7-075e90/trusted-artifacts" }, { "name": "resultArtifacts", "value": [ "$(tasks.push-snapshot.results.sourceDataArtifact)=/var/workdir/release" ] }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "taskGitRevision", "value": "development" } ], "runAfter": [ "push-snapshot", "process-component-sbom" ], "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog.git" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/update-cr-status/update-cr-status.yaml" } ], "resolver": "git" } } ] }, "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "48a31f6910278fccd79a551bac7174fb734dad3b" }, "entryPoint": "pipelines/managed/push-to-external-registry/push-to-external-registry.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog.git" } }, "skippedTasks": [ { "name": "make-repo-public", "reason": "PipelineRun was stopping", "whenExpressions": [ { "operator": "notin", "values": [ "" ] } ] }, { "name": "update-cr-status", "reason": "PipelineRun was stopping" } ], "startTime": "2026-04-24T07:51:56Z" } }, { "apiVersion": "tekton.dev/v1", "kind": "PipelineRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/rhads-tsf-qe/testrepo?rev=34b999a6f5518576552a5afe1ccfd71b9f9357d8", "build.appstudio.redhat.com/commit_sha": "34b999a6f5518576552a5afe1ccfd71b9f9357d8", "build.appstudio.redhat.com/target_branch": "base-hgaufi", "chains.tekton.dev/signed": "true", "chains.tekton.dev/transparency": "http://rekor-server.tsf-tas.svc.cluster.local/api/v1/log/entries?logIndex=39", "pac.test.appstudio.openshift.io/branch": "base-hgaufi", "pac.test.appstudio.openshift.io/cancel-in-progress": "false", "pac.test.appstudio.openshift.io/check-run-id": "72839922785", "pac.test.appstudio.openshift.io/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pac.test.appstudio.openshift.io/event-type": "push", "pac.test.appstudio.openshift.io/git-auth-secret": "pac-gitauth-hqjius", "pac.test.appstudio.openshift.io/git-provider": "github", "pac.test.appstudio.openshift.io/installation-id": "112348674", "pac.test.appstudio.openshift.io/log-url": "https://konflux-ui-konflux-ui.apps.rosa.kx-57b70f2209.qns6.p3.openshiftapps.com/ns/default-tenant/pipelinerun/my-integration-test-rdxl-tmw8l", "pac.test.appstudio.openshift.io/max-keep-runs": "3", "pac.test.appstudio.openshift.io/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-hgaufi\"", "pac.test.appstudio.openshift.io/original-prname": "tsf-demo-comp-on-push", "pac.test.appstudio.openshift.io/repo-url": "https://github.com/rhads-tsf-qe/testrepo", "pac.test.appstudio.openshift.io/repository": "tsf-demo-comp", "pac.test.appstudio.openshift.io/scm-reporting-plr-started": "true", "pac.test.appstudio.openshift.io/sender": "rhtap-ci-tests-bot", "pac.test.appstudio.openshift.io/sha": "34b999a6f5518576552a5afe1ccfd71b9f9357d8", "pac.test.appstudio.openshift.io/sha-title": "Merge pull request #218 from rhads-tsf-qe/konflux-tsf-demo-comp", "pac.test.appstudio.openshift.io/sha-url": "https://github.com/rhads-tsf-qe/testrepo/commit/34b999a6f5518576552a5afe1ccfd71b9f9357d8", "pac.test.appstudio.openshift.io/source-branch": "refs/heads/base-hgaufi", "pac.test.appstudio.openshift.io/source-repo-url": "https://github.com/rhads-tsf-qe/testrepo", "pac.test.appstudio.openshift.io/state": "completed", "pac.test.appstudio.openshift.io/url-org": "rhads-tsf-qe", "pac.test.appstudio.openshift.io/url-repository": "testrepo", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "default-tenant/results/e7887ade-d285-4a41-b33b-65e7eb0494a3/records/e7887ade-d285-4a41-b33b-65e7eb0494a3", "results.tekton.dev/result": "default-tenant/results/e7887ade-d285-4a41-b33b-65e7eb0494a3", "results.tekton.dev/stored": "true", "test.appstudio.openshift.io/integration-workflow": "push", "test.appstudio.openshift.io/pipelinerunstarttime": "1777016537000", "test.appstudio.openshift.io/source-repo-url": "https://github.com/rhads-tsf-qe/testrepo", "test.appstudio.openshift.io/status": "[{\"scenario\":\"my-integration-test-rdxl\",\"status\":\"Pending\",\"lastUpdateTime\":\"2026-04-24T07:51:23.702983195Z\",\"details\":\"Pending\"}]" }, "creationTimestamp": "2026-04-24T07:51:23Z", "finalizers": [ "chains.tekton.dev/pipelinerun", "results.tekton.dev/pipelinerun" ], "generateName": "my-integration-test-rdxl-", "generation": 1, "labels": { "appstudio.openshift.io/application": "tsf-demo-app", "appstudio.openshift.io/component": "tsf-demo-comp", "appstudio.openshift.io/snapshot": "tsf-demo-app-20260424-074217-000", "build.appstudio.redhat.com/pipeline": "enterprise-contract", "pac.test.appstudio.openshift.io/cancel-in-progress": "false", "pac.test.appstudio.openshift.io/check-run-id": "72839922785", "pac.test.appstudio.openshift.io/event-type": "push", "pac.test.appstudio.openshift.io/original-prname": "tsf-demo-comp-on-push", "pac.test.appstudio.openshift.io/repository": "tsf-demo-comp", "pac.test.appstudio.openshift.io/sha": "34b999a6f5518576552a5afe1ccfd71b9f9357d8", "pac.test.appstudio.openshift.io/state": "completed", "pac.test.appstudio.openshift.io/url-org": "rhads-tsf-qe", "pac.test.appstudio.openshift.io/url-repository": "testrepo", "pipelines.appstudio.openshift.io/type": "test", "tekton.dev/pipeline": "enterprise-contract", "test.appstudio.openshift.io/optional": "false", "test.appstudio.openshift.io/pipelinerunfinishtime": "1777017081", "test.appstudio.openshift.io/scenario": "my-integration-test-rdxl", "test.appstudio.openshift.io/type": "component" }, "name": "my-integration-test-rdxl-tmw8l", "namespace": "default-tenant", "ownerReferences": [ { "apiVersion": "appstudio.redhat.com/v1alpha1", "blockOwnerDeletion": true, "controller": true, "kind": "Snapshot", "name": "tsf-demo-app-20260424-074217-000", "uid": "f9c60d07-677a-47af-ba6b-e585cbcb5a53" } ], "resourceVersion": "47044", "uid": "e7887ade-d285-4a41-b33b-65e7eb0494a3" }, "spec": { "params": [ { "name": "SNAPSHOT", "value": "{\"application\":\"tsf-demo-app\",\"componentGroup\":\"\",\"components\":[{\"name\":\"tsf-demo-comp\",\"version\":\"\",\"containerImage\":\"quay.io/rhtap_qe/default-tenant/tsf-demo-comp@sha256:83c62967f93a8e524abe56fd1f7dac2bafaf350480c6872f6f646c0b6b2bd497\",\"source\":{\"git\":{\"url\":\"https://github.com/rhads-tsf-qe/testrepo\",\"revision\":\"34b999a6f5518576552a5afe1ccfd71b9f9357d8\"}}}],\"artifacts\":{}}" } ], "pipelineRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/build-definitions" }, { "name": "revision", "value": "main" }, { "name": "pathInRepo", "value": "pipelines/enterprise-contract.yaml" } ], "resolver": "git" }, "taskRunTemplate": { "serviceAccountName": "konflux-integration-runner" }, "timeouts": { "pipeline": "1h0m0s" } }, "status": { "childReferences": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "my-integration-test-rdxl-tmw8l-collect-keyless-params", "pipelineTaskName": "collect-keyless-params" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "my-integration-test-rdxl-tmw8l-verify", "pipelineTaskName": "verify" } ], "completionTime": "2026-04-24T07:51:50Z", "conditions": [ { "lastTransitionTime": "2026-04-24T07:51:50Z", "message": "Tasks Completed: 2 (Failed: 0, Cancelled 0), Skipped: 0", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "pipelineSpec": { "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\nEach \"containerImage\" in the \"components\" array is validated.\n", "name": "SNAPSHOT", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractConfiguration\nobject) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n\"/var/run/secrets/kubernetes.io/serviceaccount\" is a good value. Multiple\npaths can be provided by using the \":\" separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "k8s://openshift-pipelines/public-key", "description": "Public key used to verify signatures. Must be a valid k8s cosign\nreference, e.g. k8s://my-space/my-secret where my-secret contains\nthe expected cosign.pub attribute.\n", "name": "PUBLIC_KEY", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "pr/$(context.pipelineRun.name)", "description": "PipelineRun ID", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "true", "description": "A boolean flag that determines whether the result of the test will mark the TaskRun as passing or not.\nSwap to false to make the IntegrationTestScenario informative.\n\nSetting to false is useful on specific conditions but will always mark the integration test as successful and\nhumans will tend to ignore the test results if they failed. Use with caution.\n", "name": "STRICT", "type": "string" } ], "results": [ { "description": "", "name": "TEST_OUTPUT", "value": "$(tasks.verify.results.TEST_OUTPUT)" } ], "tasks": [ { "name": "collect-keyless-params", "taskRef": { "params": [ { "name": "bundle", "value": "quay.io/conforma/tekton-task:konflux" }, { "name": "name", "value": "collect-keyless-params" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "verify", "params": [ { "name": "POLICY_CONFIGURATION", "value": "enterprise-contract-service/default" }, { "name": "IMAGES", "value": "{\"application\":\"tsf-demo-app\",\"componentGroup\":\"\",\"components\":[{\"name\":\"tsf-demo-comp\",\"version\":\"\",\"containerImage\":\"quay.io/rhtap_qe/default-tenant/tsf-demo-comp@sha256:83c62967f93a8e524abe56fd1f7dac2bafaf350480c6872f6f646c0b6b2bd497\",\"source\":{\"git\":{\"url\":\"https://github.com/rhads-tsf-qe/testrepo\",\"revision\":\"34b999a6f5518576552a5afe1ccfd71b9f9357d8\"}}}],\"artifacts\":{}}" }, { "name": "SSL_CERT_DIR", "value": "" }, { "name": "STRICT", "value": "true" }, { "name": "PUBLIC_KEY", "value": "k8s://openshift-pipelines/public-key" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "CERTIFICATE_OIDC_ISSUER", "value": "$(tasks.collect-keyless-params.results.defaultOIDCIssuer)" }, { "name": "CERTIFICATE_IDENTITY", "value": "$(tasks.collect-keyless-params.results.tektonChainsIdentity)" }, { "name": "TUF_MIRROR", "value": "$(tasks.collect-keyless-params.results.tufUrl)" }, { "name": "REKOR_HOST", "value": "$(tasks.collect-keyless-params.results.rekorUrl)" }, { "name": "WORKERS", "value": "1" }, { "name": "CA_TRUST_CONFIGMAP_NAME", "value": "trusted-ca" }, { "name": "CA_TRUST_CONFIG_MAP_KEY", "value": "ca-bundle.crt" }, { "name": "EXTRA_RULE_DATA", "value": "" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "value": "pr/my-integration-test-rdxl-tmw8l" } ], "runAfter": [ "collect-keyless-params" ], "taskRef": { "params": [ { "name": "bundle", "value": "quay.io/conforma/tekton-task:konflux" }, { "name": "name", "value": "verify-enterprise-contract" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "4h0m0s" } ] }, "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "cfddeab4a0293a1c9cbe390d65aad5c658453005" }, "entryPoint": "pipelines/enterprise-contract.yaml", "uri": "git+https://github.com/konflux-ci/build-definitions" } }, "results": [ { "name": "TEST_OUTPUT", "value": "{\"timestamp\":\"1777017108\",\"namespace\":\"\",\"successes\":128,\"failures\":0,\"warnings\":4,\"result\":\"WARNING\"}\n" } ], "startTime": "2026-04-24T07:51:23Z" } }, { "apiVersion": "tekton.dev/v1", "kind": "PipelineRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/rhads-tsf-qe/testrepo?rev=5f0838507251d833df91ef169fe5c63e3c62ea0f", "build.appstudio.redhat.com/commit_sha": "5f0838507251d833df91ef169fe5c63e3c62ea0f", "build.appstudio.redhat.com/target_branch": "base-ebyreq", "chains.tekton.dev/signed": "true", "chains.tekton.dev/transparency": "http://rekor-server.tsf-tas.svc.cluster.local/api/v1/log/entries?logIndex=41", "pac.test.appstudio.openshift.io/branch": "base-ebyreq", "pac.test.appstudio.openshift.io/cancel-in-progress": "false", "pac.test.appstudio.openshift.io/check-run-id": "72839962704", "pac.test.appstudio.openshift.io/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pac.test.appstudio.openshift.io/event-type": "push", "pac.test.appstudio.openshift.io/git-auth-secret": "pac-gitauth-mgrieh", "pac.test.appstudio.openshift.io/git-provider": "github", "pac.test.appstudio.openshift.io/installation-id": "112348674", "pac.test.appstudio.openshift.io/log-url": "https://konflux-ui-konflux-ui.apps.rosa.kx-57b70f2209.qns6.p3.openshiftapps.com/ns/default-tenant/pipelinerun/my-integration-test-rdxl-wmpl6", "pac.test.appstudio.openshift.io/max-keep-runs": "3", "pac.test.appstudio.openshift.io/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-ebyreq\"", "pac.test.appstudio.openshift.io/original-prname": "tsf-demo-comp-on-push", "pac.test.appstudio.openshift.io/repo-url": "https://github.com/rhads-tsf-qe/testrepo", "pac.test.appstudio.openshift.io/repository": "tsf-demo-comp", "pac.test.appstudio.openshift.io/scm-reporting-plr-started": "true", "pac.test.appstudio.openshift.io/sender": "rhtap-ci-tests-bot", "pac.test.appstudio.openshift.io/sha": "5f0838507251d833df91ef169fe5c63e3c62ea0f", "pac.test.appstudio.openshift.io/sha-title": "Merge pull request #219 from rhads-tsf-qe/konflux-tsf-demo-comp", "pac.test.appstudio.openshift.io/sha-url": "https://github.com/rhads-tsf-qe/testrepo/commit/5f0838507251d833df91ef169fe5c63e3c62ea0f", "pac.test.appstudio.openshift.io/source-branch": "refs/heads/base-ebyreq", "pac.test.appstudio.openshift.io/source-repo-url": "https://github.com/rhads-tsf-qe/testrepo", "pac.test.appstudio.openshift.io/state": "completed", "pac.test.appstudio.openshift.io/url-org": "rhads-tsf-qe", "pac.test.appstudio.openshift.io/url-repository": "testrepo", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "default-tenant/results/ca40b4e6-270c-4dcb-ad4a-10c91e1055f8/records/ca40b4e6-270c-4dcb-ad4a-10c91e1055f8", "results.tekton.dev/result": "default-tenant/results/ca40b4e6-270c-4dcb-ad4a-10c91e1055f8", "results.tekton.dev/stored": "true", "test.appstudio.openshift.io/added-to-global-candidate-list": "{\"result\":true,\"reason\":\"Success\",\"lastupdatedtime\":\"2026-04-24T07:51:16Z\"}", "test.appstudio.openshift.io/integration-workflow": "push", "test.appstudio.openshift.io/pipelinerunstarttime": "1777016555000", "test.appstudio.openshift.io/source-repo-url": "https://github.com/rhads-tsf-qe/testrepo", "test.appstudio.openshift.io/status": "[{\"scenario\":\"my-integration-test-rdxl\",\"status\":\"Pending\",\"lastUpdateTime\":\"2026-04-24T07:51:16.765108124Z\",\"details\":\"Pending\"}]" }, "creationTimestamp": "2026-04-24T07:51:16Z", "finalizers": [ "results.tekton.dev/pipelinerun", "chains.tekton.dev/pipelinerun" ], "generateName": "my-integration-test-rdxl-", "generation": 1, "labels": { "appstudio.openshift.io/application": "tsf-demo-app", "appstudio.openshift.io/component": "tsf-demo-comp", "appstudio.openshift.io/snapshot": "tsf-demo-app-20260424-074235-000", "build.appstudio.redhat.com/pipeline": "enterprise-contract", "pac.test.appstudio.openshift.io/cancel-in-progress": "false", "pac.test.appstudio.openshift.io/check-run-id": "72839962704", "pac.test.appstudio.openshift.io/event-type": "push", "pac.test.appstudio.openshift.io/original-prname": "tsf-demo-comp-on-push", "pac.test.appstudio.openshift.io/repository": "tsf-demo-comp", "pac.test.appstudio.openshift.io/sha": "5f0838507251d833df91ef169fe5c63e3c62ea0f", "pac.test.appstudio.openshift.io/state": "completed", "pac.test.appstudio.openshift.io/url-org": "rhads-tsf-qe", "pac.test.appstudio.openshift.io/url-repository": "testrepo", "pipelines.appstudio.openshift.io/type": "test", "tekton.dev/pipeline": "enterprise-contract", "test.appstudio.openshift.io/optional": "false", "test.appstudio.openshift.io/pipelinerunfinishtime": "1777017074", "test.appstudio.openshift.io/scenario": "my-integration-test-rdxl", "test.appstudio.openshift.io/type": "component" }, "name": "my-integration-test-rdxl-wmpl6", "namespace": "default-tenant", "ownerReferences": [ { "apiVersion": "appstudio.redhat.com/v1alpha1", "blockOwnerDeletion": true, "controller": true, "kind": "Snapshot", "name": "tsf-demo-app-20260424-074235-000", "uid": "8442da4b-e483-4958-9b82-8773c51b27fe" } ], "resourceVersion": "47209", "uid": "ca40b4e6-270c-4dcb-ad4a-10c91e1055f8" }, "spec": { "params": [ { "name": "SNAPSHOT", "value": "{\"application\":\"tsf-demo-app\",\"componentGroup\":\"\",\"components\":[{\"name\":\"tsf-demo-comp\",\"version\":\"\",\"containerImage\":\"quay.io/rhtap_qe/default-tenant/tsf-demo-comp@sha256:37bd3ef5f28298e117a077124696c0db64da1a5fca1596b80e10f4d4cbab328a\",\"source\":{\"git\":{\"url\":\"https://github.com/rhads-tsf-qe/testrepo\",\"revision\":\"5f0838507251d833df91ef169fe5c63e3c62ea0f\"}}}],\"artifacts\":{}}" } ], "pipelineRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/build-definitions" }, { "name": "revision", "value": "main" }, { "name": "pathInRepo", "value": "pipelines/enterprise-contract.yaml" } ], "resolver": "git" }, "taskRunTemplate": { "serviceAccountName": "konflux-integration-runner" }, "timeouts": { "pipeline": "1h0m0s" } }, "status": { "childReferences": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "my-integration-test-rdxl-wmpl6-collect-keyless-params", "pipelineTaskName": "collect-keyless-params" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "my-integration-test-rdxl-wmpl6-verify", "pipelineTaskName": "verify" } ], "completionTime": "2026-04-24T07:51:55Z", "conditions": [ { "lastTransitionTime": "2026-04-24T07:51:55Z", "message": "Tasks Completed: 2 (Failed: 0, Cancelled 0), Skipped: 0", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "pipelineSpec": { "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\nEach \"containerImage\" in the \"components\" array is validated.\n", "name": "SNAPSHOT", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractConfiguration\nobject) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n\"/var/run/secrets/kubernetes.io/serviceaccount\" is a good value. Multiple\npaths can be provided by using the \":\" separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "k8s://openshift-pipelines/public-key", "description": "Public key used to verify signatures. Must be a valid k8s cosign\nreference, e.g. k8s://my-space/my-secret where my-secret contains\nthe expected cosign.pub attribute.\n", "name": "PUBLIC_KEY", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "pr/$(context.pipelineRun.name)", "description": "PipelineRun ID", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "true", "description": "A boolean flag that determines whether the result of the test will mark the TaskRun as passing or not.\nSwap to false to make the IntegrationTestScenario informative.\n\nSetting to false is useful on specific conditions but will always mark the integration test as successful and\nhumans will tend to ignore the test results if they failed. Use with caution.\n", "name": "STRICT", "type": "string" } ], "results": [ { "description": "", "name": "TEST_OUTPUT", "value": "$(tasks.verify.results.TEST_OUTPUT)" } ], "tasks": [ { "name": "collect-keyless-params", "taskRef": { "params": [ { "name": "bundle", "value": "quay.io/conforma/tekton-task:konflux" }, { "name": "name", "value": "collect-keyless-params" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "verify", "params": [ { "name": "POLICY_CONFIGURATION", "value": "enterprise-contract-service/default" }, { "name": "IMAGES", "value": "{\"application\":\"tsf-demo-app\",\"componentGroup\":\"\",\"components\":[{\"name\":\"tsf-demo-comp\",\"version\":\"\",\"containerImage\":\"quay.io/rhtap_qe/default-tenant/tsf-demo-comp@sha256:37bd3ef5f28298e117a077124696c0db64da1a5fca1596b80e10f4d4cbab328a\",\"source\":{\"git\":{\"url\":\"https://github.com/rhads-tsf-qe/testrepo\",\"revision\":\"5f0838507251d833df91ef169fe5c63e3c62ea0f\"}}}],\"artifacts\":{}}" }, { "name": "SSL_CERT_DIR", "value": "" }, { "name": "STRICT", "value": "true" }, { "name": "PUBLIC_KEY", "value": "k8s://openshift-pipelines/public-key" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "CERTIFICATE_OIDC_ISSUER", "value": "$(tasks.collect-keyless-params.results.defaultOIDCIssuer)" }, { "name": "CERTIFICATE_IDENTITY", "value": "$(tasks.collect-keyless-params.results.tektonChainsIdentity)" }, { "name": "TUF_MIRROR", "value": "$(tasks.collect-keyless-params.results.tufUrl)" }, { "name": "REKOR_HOST", "value": "$(tasks.collect-keyless-params.results.rekorUrl)" }, { "name": "WORKERS", "value": "1" }, { "name": "CA_TRUST_CONFIGMAP_NAME", "value": "trusted-ca" }, { "name": "CA_TRUST_CONFIG_MAP_KEY", "value": "ca-bundle.crt" }, { "name": "EXTRA_RULE_DATA", "value": "" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "value": "pr/my-integration-test-rdxl-wmpl6" } ], "runAfter": [ "collect-keyless-params" ], "taskRef": { "params": [ { "name": "bundle", "value": "quay.io/conforma/tekton-task:konflux" }, { "name": "name", "value": "verify-enterprise-contract" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "4h0m0s" } ] }, "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "cfddeab4a0293a1c9cbe390d65aad5c658453005" }, "entryPoint": "pipelines/enterprise-contract.yaml", "uri": "git+https://github.com/konflux-ci/build-definitions" } }, "results": [ { "name": "TEST_OUTPUT", "value": "{\"timestamp\":\"1777017113\",\"namespace\":\"\",\"successes\":128,\"failures\":0,\"warnings\":4,\"result\":\"WARNING\"}\n" } ], "startTime": "2026-04-24T07:51:17Z" } }, { "apiVersion": "tekton.dev/v1", "kind": "PipelineRun", "metadata": { "annotations": { "appstudio.openshift.io/snapshot": "tsf-demo-app-20260424-074217-000", "appstudio.openshift.io/snapshots": "tsf-demo-app-20260424-074217-000", "build.appstudio.openshift.io/repo": "https://github.com/rhads-tsf-qe/testrepo?rev=34b999a6f5518576552a5afe1ccfd71b9f9357d8", "build.appstudio.redhat.com/commit_sha": "34b999a6f5518576552a5afe1ccfd71b9f9357d8", "build.appstudio.redhat.com/target_branch": "base-hgaufi", "chains.tekton.dev/signed": "true", "chains.tekton.dev/transparency": "http://rekor-server.tsf-tas.svc.cluster.local/api/v1/log/entries?logIndex=35", "pipelinesascode.tekton.dev/branch": "base-hgaufi", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "72839922785", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-hqjius", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "112348674", "pipelinesascode.tekton.dev/log-url": "https://konflux-ui-konflux-ui.apps.rosa.kx-57b70f2209.qns6.p3.openshiftapps.com/ns/default-tenant/pipelinerun/tsf-demo-comp-on-push-glt8h", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-hgaufi\"", "pipelinesascode.tekton.dev/original-prname": "tsf-demo-comp-on-push", "pipelinesascode.tekton.dev/repo-url": "https://github.com/rhads-tsf-qe/testrepo", "pipelinesascode.tekton.dev/repository": "tsf-demo-comp", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "rhtap-ci-tests-bot", "pipelinesascode.tekton.dev/sha": "34b999a6f5518576552a5afe1ccfd71b9f9357d8", "pipelinesascode.tekton.dev/sha-title": "Merge pull request #218 from rhads-tsf-qe/konflux-tsf-demo-comp", "pipelinesascode.tekton.dev/sha-url": "https://github.com/rhads-tsf-qe/testrepo/commit/34b999a6f5518576552a5afe1ccfd71b9f9357d8", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-hgaufi", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/rhads-tsf-qe/testrepo", "pipelinesascode.tekton.dev/state": "completed", "pipelinesascode.tekton.dev/url-org": "rhads-tsf-qe", "pipelinesascode.tekton.dev/url-repository": "testrepo", "results.tekton.dev/record": "default-tenant/results/1e5e2c74-a0ee-42eb-9947-a1d531b36ad7/records/1e5e2c74-a0ee-42eb-9947-a1d531b36ad7", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"testrepo\",\"commit\":\"34b999a6f5518576552a5afe1ccfd71b9f9357d8\",\"eventType\":\"push\"}", "results.tekton.dev/result": "default-tenant/results/1e5e2c74-a0ee-42eb-9947-a1d531b36ad7", "results.tekton.dev/stored": "true", "test.appstudio.openshift.io/create-snapshot-status": "{\"message\":\"Sucessfully created snapshot. See annotation appstudio.openshift.io/snapshot for name\",\"status\":\"success\"}" }, "creationTimestamp": "2026-04-24T07:42:16Z", "finalizers": [ "results.tekton.dev/pipelinerun", "pipelinesascode.tekton.dev/finalizer", "chains.tekton.dev/pipelinerun" ], "generateName": "tsf-demo-comp-on-push-", "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.37.7", "appstudio.openshift.io/application": "tsf-demo-app", "appstudio.openshift.io/component": "tsf-demo-comp", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "72839922785", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "tsf-demo-comp-on-push", "pipelinesascode.tekton.dev/repository": "tsf-demo-comp", "pipelinesascode.tekton.dev/sha": "34b999a6f5518576552a5afe1ccfd71b9f9357d8", "pipelinesascode.tekton.dev/state": "completed", "pipelinesascode.tekton.dev/url-org": "rhads-tsf-qe", "pipelinesascode.tekton.dev/url-repository": "testrepo", "tekton.dev/pipeline": "tsf-demo-comp-on-push-glt8h" }, "name": "tsf-demo-comp-on-push-glt8h", "namespace": "default-tenant", "resourceVersion": "46670", "uid": "1e5e2c74-a0ee-42eb-9947-a1d531b36ad7" }, "spec": { "params": [ { "name": "git-url", "value": "https://github.com/rhads-tsf-qe/testrepo" }, { "name": "revision", "value": "34b999a6f5518576552a5afe1ccfd71b9f9357d8" }, { "name": "output-image", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:34b999a6f5518576552a5afe1ccfd71b9f9357d8" }, { "name": "dockerfile", "value": "Dockerfile" } ], "pipelineSpec": { "description": "This pipeline is ideal for building demo container images from a Containerfile while maintaining trust after pipeline customization.\n\nThis version of pipeline has minimal resource requests set, it's good for demonstrating and testing.\n\n_Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks.\nThis pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_\n", "params": [ { "description": "Source Repository URL", "name": "git-url", "type": "string" }, { "default": "", "description": "Revision of the Source Repository", "name": "revision", "type": "string" }, { "description": "Fully Qualified Output Image", "name": "output-image", "type": "string" }, { "default": ".", "description": "Path to the source code of an application's component from where to build image.", "name": "path-context", "type": "string" }, { "default": "Dockerfile", "description": "Path to the Dockerfile inside the context specified by parameter path-context", "name": "dockerfile", "type": "string" }, { "default": "false", "description": "Skip checks against built image", "name": "skip-checks", "type": "string" }, { "default": "false", "description": "Execute the build with network isolation", "name": "hermetic", "type": "string" }, { "default": "", "description": "Build dependencies to be prefetched", "name": "prefetch-input", "type": "string" }, { "default": "", "description": "Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "image-expires-after", "type": "string" }, { "default": "false", "description": "Add built image into an OCI image index", "name": "build-image-index", "type": "string" }, { "default": "docker", "description": "The format for the resulting image's mediaType. Valid values are oci or docker.", "name": "buildah-format", "type": "string" }, { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings) for buildah", "name": "build-args", "type": "array" }, { "default": "", "description": "Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "build-args-file", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "privileged-nested", "type": "string" } ], "results": [ { "description": "", "name": "IMAGE_URL", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "description": "", "name": "IMAGE_DIGEST", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "description": "", "name": "CHAINS-GIT_URL", "value": "$(tasks.clone-repository.results.url)" }, { "description": "", "name": "CHAINS-GIT_COMMIT", "value": "$(tasks.clone-repository.results.commit)" } ], "tasks": [ { "name": "init", "params": [ { "name": "enable-cache-proxy", "value": "$(params.enable-cache-proxy)" } ], "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:288f3106118edc1d0f0c79a89c960abf5841a4dd8bc3f38feb10527253105b19" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "clone-repository", "params": [ { "name": "url", "value": "$(params.git-url)" }, { "name": "revision", "value": "$(params.revision)" }, { "name": "ociStorage", "value": "$(params.output-image).git" }, { "name": "ociArtifactExpiresAfter", "value": "$(params.image-expires-after)" } ], "runAfter": [ "init" ], "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:2fff50eaed7d278c3ed82375d28241eaf6eecbc389ec4d44992721786a0dfa68" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "workspaces": [ { "name": "basic-auth", "workspace": "git-auth" } ] }, { "name": "prefetch-dependencies", "params": [ { "name": "input", "value": "$(params.prefetch-input)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.clone-repository.results.SOURCE_ARTIFACT)" }, { "name": "ociStorage", "value": "$(params.output-image).prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "$(params.image-expires-after)" } ], "runAfter": [ "clone-repository" ], "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:1a41e7ee19f9e02874b4ef1f74e6f588a7601deaf5b30ca0862808e5760cea5d" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "workspaces": [ { "name": "git-basic-auth", "workspace": "git-auth" }, { "name": "netrc", "workspace": "netrc" } ] }, { "name": "build-container", "params": [ { "name": "IMAGE", "value": "$(params.output-image)" }, { "name": "DOCKERFILE", "value": "$(params.dockerfile)" }, { "name": "CONTEXT", "value": "$(params.path-context)" }, { "name": "HERMETIC", "value": "$(params.hermetic)" }, { "name": "PREFETCH_INPUT", "value": "$(params.prefetch-input)" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "$(params.image-expires-after)" }, { "name": "COMMIT_SHA", "value": "$(tasks.clone-repository.results.commit)" }, { "name": "BUILD_ARGS", "value": [ "$(params.build-args[*])" ] }, { "name": "BUILD_ARGS_FILE", "value": "$(params.build-args-file)" }, { "name": "PRIVILEGED_NESTED", "value": "$(params.privileged-nested)" }, { "name": "SOURCE_URL", "value": "$(tasks.clone-repository.results.url)" }, { "name": "BUILDAH_FORMAT", "value": "$(params.buildah-format)" }, { "name": "HTTP_PROXY", "value": "$(tasks.init.results.http-proxy)" }, { "name": "NO_PROXY", "value": "$(tasks.init.results.no-proxy)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "prefetch-dependencies" ], "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:95c1b5a8b454e19bd4eb28bf90ee0247467743d0e0f5737d952dce1a99108d2f" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "build-image-index", "params": [ { "name": "IMAGE", "value": "$(params.output-image)" }, { "name": "COMMIT_SHA", "value": "$(tasks.clone-repository.results.commit)" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "$(params.image-expires-after)" }, { "name": "ALWAYS_BUILD_INDEX", "value": "$(params.build-image-index)" }, { "name": "IMAGES", "value": [ "$(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST)" ] }, { "name": "BUILDAH_FORMAT", "value": "$(params.buildah-format)" } ], "runAfter": [ "build-container" ], "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.2@sha256:79b412747e07caf80cace222ef8ee7e7955676f7928b893ed39c107f4ec62bf3" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "deprecated-base-image-check", "params": [ { "name": "IMAGE_URL", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "IMAGE_DIGEST", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "clair-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "clair-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan-min:0.3@sha256:c117d0fd0b5413b5addb014027f06b1ea2c39c8e962876810c40c7baf5b54e72" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "clamav-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "sast-shell-check", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "sast-shell-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:fa19753f59288a397aab2ddb9459f35f0ec1b89f43c36e944a3958db72becb5a" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "sast-unicode-check", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:624d9ed6d461b59a16d8c1578276626c02fa6d56e0ee4bcd752f7859055f21ab" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "rpms-signature-scan", "params": [ { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:47b81d6b3d752649eddfbb8b3fd8f6522c4bb07f6d1946f9bc45dae3f92e2c9a" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "tpa-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "tpa-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] } ], "workspaces": [ { "name": "git-auth", "optional": true }, { "name": "netrc", "optional": true } ] }, "taskRunTemplate": { "serviceAccountName": "build-pipeline-tsf-demo-comp" }, "timeouts": { "pipeline": "1h0m0s" }, "workspaces": [ { "name": "git-auth", "secret": { "secretName": "pac-gitauth-hqjius" } } ] }, "status": { "childReferences": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-init", "pipelineTaskName": "init" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-clone-repository", "pipelineTaskName": "clone-repository" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-prefetch-dependencies", "pipelineTaskName": "prefetch-dependencies" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-build-container", "pipelineTaskName": "build-container" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-build-image-index", "pipelineTaskName": "build-image-index" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-deprecated-base-image-check", "pipelineTaskName": "deprecated-base-image-check", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-clair-scan", "pipelineTaskName": "clair-scan", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-clamav-scan", "pipelineTaskName": "clamav-scan", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-sast-shell-check", "pipelineTaskName": "sast-shell-check", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-sast-unicode-check", "pipelineTaskName": "sast-unicode-check", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-rpms-signature-scan", "pipelineTaskName": "rpms-signature-scan", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-glt8h-tpa-scan", "pipelineTaskName": "tpa-scan", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] } ], "completionTime": "2026-04-24T07:51:21Z", "conditions": [ { "lastTransitionTime": "2026-04-24T07:51:21Z", "message": "Tasks Completed: 12 (Failed: 0, Cancelled 0), Skipped: 0", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "pipelineSpec": { "description": "This pipeline is ideal for building demo container images from a Containerfile while maintaining trust after pipeline customization.\n\nThis version of pipeline has minimal resource requests set, it's good for demonstrating and testing.\n\n_Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks.\nThis pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_\n", "params": [ { "description": "Source Repository URL", "name": "git-url", "type": "string" }, { "default": "", "description": "Revision of the Source Repository", "name": "revision", "type": "string" }, { "description": "Fully Qualified Output Image", "name": "output-image", "type": "string" }, { "default": ".", "description": "Path to the source code of an application's component from where to build image.", "name": "path-context", "type": "string" }, { "default": "Dockerfile", "description": "Path to the Dockerfile inside the context specified by parameter path-context", "name": "dockerfile", "type": "string" }, { "default": "false", "description": "Skip checks against built image", "name": "skip-checks", "type": "string" }, { "default": "false", "description": "Execute the build with network isolation", "name": "hermetic", "type": "string" }, { "default": "", "description": "Build dependencies to be prefetched", "name": "prefetch-input", "type": "string" }, { "default": "", "description": "Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "image-expires-after", "type": "string" }, { "default": "false", "description": "Add built image into an OCI image index", "name": "build-image-index", "type": "string" }, { "default": "docker", "description": "The format for the resulting image's mediaType. Valid values are oci or docker.", "name": "buildah-format", "type": "string" }, { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings) for buildah", "name": "build-args", "type": "array" }, { "default": "", "description": "Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "build-args-file", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "privileged-nested", "type": "string" } ], "results": [ { "description": "", "name": "IMAGE_URL", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "description": "", "name": "IMAGE_DIGEST", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "description": "", "name": "CHAINS-GIT_URL", "value": "$(tasks.clone-repository.results.url)" }, { "description": "", "name": "CHAINS-GIT_COMMIT", "value": "$(tasks.clone-repository.results.commit)" } ], "tasks": [ { "name": "init", "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:288f3106118edc1d0f0c79a89c960abf5841a4dd8bc3f38feb10527253105b19" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "clone-repository", "params": [ { "name": "url", "value": "https://github.com/rhads-tsf-qe/testrepo" }, { "name": "revision", "value": "34b999a6f5518576552a5afe1ccfd71b9f9357d8" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:34b999a6f5518576552a5afe1ccfd71b9f9357d8.git" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "runAfter": [ "init" ], "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:2fff50eaed7d278c3ed82375d28241eaf6eecbc389ec4d44992721786a0dfa68" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "workspaces": [ { "name": "basic-auth", "workspace": "git-auth" } ] }, { "name": "prefetch-dependencies", "params": [ { "name": "input", "value": "" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.clone-repository.results.SOURCE_ARTIFACT)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:34b999a6f5518576552a5afe1ccfd71b9f9357d8.prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "runAfter": [ "clone-repository" ], "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:1a41e7ee19f9e02874b4ef1f74e6f588a7601deaf5b30ca0862808e5760cea5d" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "workspaces": [ { "name": "git-basic-auth", "workspace": "git-auth" }, { "name": "netrc", "workspace": "netrc" } ] }, { "name": "build-container", "params": [ { "name": "IMAGE", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:34b999a6f5518576552a5afe1ccfd71b9f9357d8" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "" }, { "name": "COMMIT_SHA", "value": "$(tasks.clone-repository.results.commit)" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "$(tasks.clone-repository.results.url)" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "$(tasks.init.results.http-proxy)" }, { "name": "NO_PROXY", "value": "$(tasks.init.results.no-proxy)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "prefetch-dependencies" ], "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:95c1b5a8b454e19bd4eb28bf90ee0247467743d0e0f5737d952dce1a99108d2f" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "build-image-index", "params": [ { "name": "IMAGE", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:34b999a6f5518576552a5afe1ccfd71b9f9357d8" }, { "name": "COMMIT_SHA", "value": "$(tasks.clone-repository.results.commit)" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "$(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST)" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "runAfter": [ "build-container" ], "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.2@sha256:79b412747e07caf80cace222ef8ee7e7955676f7928b893ed39c107f4ec62bf3" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "deprecated-base-image-check", "params": [ { "name": "IMAGE_URL", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "IMAGE_DIGEST", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "clair-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "clair-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan-min:0.3@sha256:c117d0fd0b5413b5addb014027f06b1ea2c39c8e962876810c40c7baf5b54e72" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "clamav-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "sast-shell-check", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "sast-shell-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:fa19753f59288a397aab2ddb9459f35f0ec1b89f43c36e944a3958db72becb5a" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "sast-unicode-check", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:624d9ed6d461b59a16d8c1578276626c02fa6d56e0ee4bcd752f7859055f21ab" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "rpms-signature-scan", "params": [ { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:47b81d6b3d752649eddfbb8b3fd8f6522c4bb07f6d1946f9bc45dae3f92e2c9a" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "tpa-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "tpa-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] } ], "workspaces": [ { "name": "git-auth", "optional": true }, { "name": "netrc", "optional": true } ] }, "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "results": [ { "name": "IMAGE_URL", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:34b999a6f5518576552a5afe1ccfd71b9f9357d8" }, { "name": "IMAGE_DIGEST", "value": "sha256:83c62967f93a8e524abe56fd1f7dac2bafaf350480c6872f6f646c0b6b2bd497" }, { "name": "CHAINS-GIT_URL", "value": "https://github.com/rhads-tsf-qe/testrepo" }, { "name": "CHAINS-GIT_COMMIT", "value": "34b999a6f5518576552a5afe1ccfd71b9f9357d8" } ], "startTime": "2026-04-24T07:42:17Z" } }, { "apiVersion": "tekton.dev/v1", "kind": "PipelineRun", "metadata": { "annotations": { "appstudio.openshift.io/snapshot": "tsf-demo-app-20260424-074235-000", "appstudio.openshift.io/snapshots": "tsf-demo-app-20260424-074235-000", "build.appstudio.openshift.io/repo": "https://github.com/rhads-tsf-qe/testrepo?rev=5f0838507251d833df91ef169fe5c63e3c62ea0f", "build.appstudio.redhat.com/commit_sha": "5f0838507251d833df91ef169fe5c63e3c62ea0f", "build.appstudio.redhat.com/target_branch": "base-ebyreq", "chains.tekton.dev/signed": "true", "chains.tekton.dev/transparency": "http://rekor-server.tsf-tas.svc.cluster.local/api/v1/log/entries?logIndex=33", "pipelinesascode.tekton.dev/branch": "base-ebyreq", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "72839962704", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mgrieh", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "112348674", "pipelinesascode.tekton.dev/log-url": "https://konflux-ui-konflux-ui.apps.rosa.kx-57b70f2209.qns6.p3.openshiftapps.com/ns/default-tenant/pipelinerun/tsf-demo-comp-on-push-mclph", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-ebyreq\"", "pipelinesascode.tekton.dev/original-prname": "tsf-demo-comp-on-push", "pipelinesascode.tekton.dev/repo-url": "https://github.com/rhads-tsf-qe/testrepo", "pipelinesascode.tekton.dev/repository": "tsf-demo-comp", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "rhtap-ci-tests-bot", "pipelinesascode.tekton.dev/sha": "5f0838507251d833df91ef169fe5c63e3c62ea0f", "pipelinesascode.tekton.dev/sha-title": "Merge pull request #219 from rhads-tsf-qe/konflux-tsf-demo-comp", "pipelinesascode.tekton.dev/sha-url": "https://github.com/rhads-tsf-qe/testrepo/commit/5f0838507251d833df91ef169fe5c63e3c62ea0f", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-ebyreq", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/rhads-tsf-qe/testrepo", "pipelinesascode.tekton.dev/state": "completed", "pipelinesascode.tekton.dev/url-org": "rhads-tsf-qe", "pipelinesascode.tekton.dev/url-repository": "testrepo", "results.tekton.dev/record": "default-tenant/results/d50be7cf-e53f-4aae-84df-ee05cc662bc2/records/d50be7cf-e53f-4aae-84df-ee05cc662bc2", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"testrepo\",\"commit\":\"5f0838507251d833df91ef169fe5c63e3c62ea0f\",\"eventType\":\"push\"}", "results.tekton.dev/result": "default-tenant/results/d50be7cf-e53f-4aae-84df-ee05cc662bc2", "results.tekton.dev/stored": "true", "test.appstudio.openshift.io/added-to-global-candidate-list": "{\"result\":true,\"reason\":\"Success\",\"lastupdatedtime\":\"2026-04-24T07:51:16Z\"}", "test.appstudio.openshift.io/create-snapshot-status": "{\"message\":\"Sucessfully created snapshot. See annotation appstudio.openshift.io/snapshot for name\",\"status\":\"success\"}" }, "creationTimestamp": "2026-04-24T07:42:35Z", "finalizers": [ "chains.tekton.dev/pipelinerun", "pipelinesascode.tekton.dev/finalizer", "results.tekton.dev/pipelinerun" ], "generateName": "tsf-demo-comp-on-push-", "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.37.7", "appstudio.openshift.io/application": "tsf-demo-app", "appstudio.openshift.io/component": "tsf-demo-comp", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "72839962704", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "tsf-demo-comp-on-push", "pipelinesascode.tekton.dev/repository": "tsf-demo-comp", "pipelinesascode.tekton.dev/sha": "5f0838507251d833df91ef169fe5c63e3c62ea0f", "pipelinesascode.tekton.dev/state": "completed", "pipelinesascode.tekton.dev/url-org": "rhads-tsf-qe", "pipelinesascode.tekton.dev/url-repository": "testrepo", "tekton.dev/pipeline": "tsf-demo-comp-on-push-mclph" }, "name": "tsf-demo-comp-on-push-mclph", "namespace": "default-tenant", "resourceVersion": "46388", "uid": "d50be7cf-e53f-4aae-84df-ee05cc662bc2" }, "spec": { "params": [ { "name": "git-url", "value": "https://github.com/rhads-tsf-qe/testrepo" }, { "name": "revision", "value": "5f0838507251d833df91ef169fe5c63e3c62ea0f" }, { "name": "output-image", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:5f0838507251d833df91ef169fe5c63e3c62ea0f" }, { "name": "dockerfile", "value": "Dockerfile" } ], "pipelineSpec": { "description": "This pipeline is ideal for building demo container images from a Containerfile while maintaining trust after pipeline customization.\n\nThis version of pipeline has minimal resource requests set, it's good for demonstrating and testing.\n\n_Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks.\nThis pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_\n", "params": [ { "description": "Source Repository URL", "name": "git-url", "type": "string" }, { "default": "", "description": "Revision of the Source Repository", "name": "revision", "type": "string" }, { "description": "Fully Qualified Output Image", "name": "output-image", "type": "string" }, { "default": ".", "description": "Path to the source code of an application's component from where to build image.", "name": "path-context", "type": "string" }, { "default": "Dockerfile", "description": "Path to the Dockerfile inside the context specified by parameter path-context", "name": "dockerfile", "type": "string" }, { "default": "false", "description": "Skip checks against built image", "name": "skip-checks", "type": "string" }, { "default": "false", "description": "Execute the build with network isolation", "name": "hermetic", "type": "string" }, { "default": "", "description": "Build dependencies to be prefetched", "name": "prefetch-input", "type": "string" }, { "default": "", "description": "Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "image-expires-after", "type": "string" }, { "default": "false", "description": "Add built image into an OCI image index", "name": "build-image-index", "type": "string" }, { "default": "docker", "description": "The format for the resulting image's mediaType. Valid values are oci or docker.", "name": "buildah-format", "type": "string" }, { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings) for buildah", "name": "build-args", "type": "array" }, { "default": "", "description": "Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "build-args-file", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "privileged-nested", "type": "string" } ], "results": [ { "description": "", "name": "IMAGE_URL", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "description": "", "name": "IMAGE_DIGEST", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "description": "", "name": "CHAINS-GIT_URL", "value": "$(tasks.clone-repository.results.url)" }, { "description": "", "name": "CHAINS-GIT_COMMIT", "value": "$(tasks.clone-repository.results.commit)" } ], "tasks": [ { "name": "init", "params": [ { "name": "enable-cache-proxy", "value": "$(params.enable-cache-proxy)" } ], "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:288f3106118edc1d0f0c79a89c960abf5841a4dd8bc3f38feb10527253105b19" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "clone-repository", "params": [ { "name": "url", "value": "$(params.git-url)" }, { "name": "revision", "value": "$(params.revision)" }, { "name": "ociStorage", "value": "$(params.output-image).git" }, { "name": "ociArtifactExpiresAfter", "value": "$(params.image-expires-after)" } ], "runAfter": [ "init" ], "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:2fff50eaed7d278c3ed82375d28241eaf6eecbc389ec4d44992721786a0dfa68" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "workspaces": [ { "name": "basic-auth", "workspace": "git-auth" } ] }, { "name": "prefetch-dependencies", "params": [ { "name": "input", "value": "$(params.prefetch-input)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.clone-repository.results.SOURCE_ARTIFACT)" }, { "name": "ociStorage", "value": "$(params.output-image).prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "$(params.image-expires-after)" } ], "runAfter": [ "clone-repository" ], "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:1a41e7ee19f9e02874b4ef1f74e6f588a7601deaf5b30ca0862808e5760cea5d" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "workspaces": [ { "name": "git-basic-auth", "workspace": "git-auth" }, { "name": "netrc", "workspace": "netrc" } ] }, { "name": "build-container", "params": [ { "name": "IMAGE", "value": "$(params.output-image)" }, { "name": "DOCKERFILE", "value": "$(params.dockerfile)" }, { "name": "CONTEXT", "value": "$(params.path-context)" }, { "name": "HERMETIC", "value": "$(params.hermetic)" }, { "name": "PREFETCH_INPUT", "value": "$(params.prefetch-input)" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "$(params.image-expires-after)" }, { "name": "COMMIT_SHA", "value": "$(tasks.clone-repository.results.commit)" }, { "name": "BUILD_ARGS", "value": [ "$(params.build-args[*])" ] }, { "name": "BUILD_ARGS_FILE", "value": "$(params.build-args-file)" }, { "name": "PRIVILEGED_NESTED", "value": "$(params.privileged-nested)" }, { "name": "SOURCE_URL", "value": "$(tasks.clone-repository.results.url)" }, { "name": "BUILDAH_FORMAT", "value": "$(params.buildah-format)" }, { "name": "HTTP_PROXY", "value": "$(tasks.init.results.http-proxy)" }, { "name": "NO_PROXY", "value": "$(tasks.init.results.no-proxy)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "prefetch-dependencies" ], "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:95c1b5a8b454e19bd4eb28bf90ee0247467743d0e0f5737d952dce1a99108d2f" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "build-image-index", "params": [ { "name": "IMAGE", "value": "$(params.output-image)" }, { "name": "COMMIT_SHA", "value": "$(tasks.clone-repository.results.commit)" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "$(params.image-expires-after)" }, { "name": "ALWAYS_BUILD_INDEX", "value": "$(params.build-image-index)" }, { "name": "IMAGES", "value": [ "$(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST)" ] }, { "name": "BUILDAH_FORMAT", "value": "$(params.buildah-format)" } ], "runAfter": [ "build-container" ], "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.2@sha256:79b412747e07caf80cace222ef8ee7e7955676f7928b893ed39c107f4ec62bf3" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "deprecated-base-image-check", "params": [ { "name": "IMAGE_URL", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "IMAGE_DIGEST", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "clair-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "clair-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan-min:0.3@sha256:c117d0fd0b5413b5addb014027f06b1ea2c39c8e962876810c40c7baf5b54e72" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "clamav-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "sast-shell-check", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "sast-shell-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:fa19753f59288a397aab2ddb9459f35f0ec1b89f43c36e944a3958db72becb5a" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "sast-unicode-check", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:624d9ed6d461b59a16d8c1578276626c02fa6d56e0ee4bcd752f7859055f21ab" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "rpms-signature-scan", "params": [ { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:47b81d6b3d752649eddfbb8b3fd8f6522c4bb07f6d1946f9bc45dae3f92e2c9a" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] }, { "name": "tpa-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "tpa-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "$(params.skip-checks)", "operator": "in", "values": [ "false" ] } ] } ], "workspaces": [ { "name": "git-auth", "optional": true }, { "name": "netrc", "optional": true } ] }, "taskRunTemplate": { "serviceAccountName": "build-pipeline-tsf-demo-comp" }, "timeouts": { "pipeline": "1h0m0s" }, "workspaces": [ { "name": "git-auth", "secret": { "secretName": "pac-gitauth-mgrieh" } } ] }, "status": { "childReferences": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-init", "pipelineTaskName": "init" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-clone-repository", "pipelineTaskName": "clone-repository" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-prefetch-dependencies", "pipelineTaskName": "prefetch-dependencies" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-build-container", "pipelineTaskName": "build-container" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-build-image-index", "pipelineTaskName": "build-image-index" }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-deprecated-base-image-check", "pipelineTaskName": "deprecated-base-image-check", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-clair-scan", "pipelineTaskName": "clair-scan", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-clamav-scan", "pipelineTaskName": "clamav-scan", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-sast-shell-check", "pipelineTaskName": "sast-shell-check", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-sast-unicode-check", "pipelineTaskName": "sast-unicode-check", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-rpms-signature-scan", "pipelineTaskName": "rpms-signature-scan", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "name": "tsf-demo-comp-on-push-mclph-tpa-scan", "pipelineTaskName": "tpa-scan", "whenExpressions": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] } ], "completionTime": "2026-04-24T07:51:14Z", "conditions": [ { "lastTransitionTime": "2026-04-24T07:51:14Z", "message": "Tasks Completed: 12 (Failed: 0, Cancelled 0), Skipped: 0", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "pipelineSpec": { "description": "This pipeline is ideal for building demo container images from a Containerfile while maintaining trust after pipeline customization.\n\nThis version of pipeline has minimal resource requests set, it's good for demonstrating and testing.\n\n_Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks.\nThis pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_\n", "params": [ { "description": "Source Repository URL", "name": "git-url", "type": "string" }, { "default": "", "description": "Revision of the Source Repository", "name": "revision", "type": "string" }, { "description": "Fully Qualified Output Image", "name": "output-image", "type": "string" }, { "default": ".", "description": "Path to the source code of an application's component from where to build image.", "name": "path-context", "type": "string" }, { "default": "Dockerfile", "description": "Path to the Dockerfile inside the context specified by parameter path-context", "name": "dockerfile", "type": "string" }, { "default": "false", "description": "Skip checks against built image", "name": "skip-checks", "type": "string" }, { "default": "false", "description": "Execute the build with network isolation", "name": "hermetic", "type": "string" }, { "default": "", "description": "Build dependencies to be prefetched", "name": "prefetch-input", "type": "string" }, { "default": "", "description": "Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "image-expires-after", "type": "string" }, { "default": "false", "description": "Add built image into an OCI image index", "name": "build-image-index", "type": "string" }, { "default": "docker", "description": "The format for the resulting image's mediaType. Valid values are oci or docker.", "name": "buildah-format", "type": "string" }, { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings) for buildah", "name": "build-args", "type": "array" }, { "default": "", "description": "Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "build-args-file", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "privileged-nested", "type": "string" } ], "results": [ { "description": "", "name": "IMAGE_URL", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "description": "", "name": "IMAGE_DIGEST", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "description": "", "name": "CHAINS-GIT_URL", "value": "$(tasks.clone-repository.results.url)" }, { "description": "", "name": "CHAINS-GIT_COMMIT", "value": "$(tasks.clone-repository.results.commit)" } ], "tasks": [ { "name": "init", "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:288f3106118edc1d0f0c79a89c960abf5841a4dd8bc3f38feb10527253105b19" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "clone-repository", "params": [ { "name": "url", "value": "https://github.com/rhads-tsf-qe/testrepo" }, { "name": "revision", "value": "5f0838507251d833df91ef169fe5c63e3c62ea0f" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:5f0838507251d833df91ef169fe5c63e3c62ea0f.git" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "runAfter": [ "init" ], "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:2fff50eaed7d278c3ed82375d28241eaf6eecbc389ec4d44992721786a0dfa68" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "workspaces": [ { "name": "basic-auth", "workspace": "git-auth" } ] }, { "name": "prefetch-dependencies", "params": [ { "name": "input", "value": "" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.clone-repository.results.SOURCE_ARTIFACT)" }, { "name": "ociStorage", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:5f0838507251d833df91ef169fe5c63e3c62ea0f.prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "runAfter": [ "clone-repository" ], "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:1a41e7ee19f9e02874b4ef1f74e6f588a7601deaf5b30ca0862808e5760cea5d" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "workspaces": [ { "name": "git-basic-auth", "workspace": "git-auth" }, { "name": "netrc", "workspace": "netrc" } ] }, { "name": "build-container", "params": [ { "name": "IMAGE", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:5f0838507251d833df91ef169fe5c63e3c62ea0f" }, { "name": "DOCKERFILE", "value": "Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "" }, { "name": "COMMIT_SHA", "value": "$(tasks.clone-repository.results.commit)" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "$(tasks.clone-repository.results.url)" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "$(tasks.init.results.http-proxy)" }, { "name": "NO_PROXY", "value": "$(tasks.init.results.no-proxy)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "prefetch-dependencies" ], "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:95c1b5a8b454e19bd4eb28bf90ee0247467743d0e0f5737d952dce1a99108d2f" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "build-image-index", "params": [ { "name": "IMAGE", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:5f0838507251d833df91ef169fe5c63e3c62ea0f" }, { "name": "COMMIT_SHA", "value": "$(tasks.clone-repository.results.commit)" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "$(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST)" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "runAfter": [ "build-container" ], "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.2@sha256:79b412747e07caf80cace222ef8ee7e7955676f7928b893ed39c107f4ec62bf3" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" } }, { "name": "deprecated-base-image-check", "params": [ { "name": "IMAGE_URL", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "IMAGE_DIGEST", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "clair-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "clair-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan-min:0.3@sha256:c117d0fd0b5413b5addb014027f06b1ea2c39c8e962876810c40c7baf5b54e72" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "clamav-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "sast-shell-check", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "sast-shell-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:fa19753f59288a397aab2ddb9459f35f0ec1b89f43c36e944a3958db72becb5a" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "sast-unicode-check", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "SOURCE_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)" }, { "name": "CACHI2_ARTIFACT", "value": "$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:624d9ed6d461b59a16d8c1578276626c02fa6d56e0ee4bcd752f7859055f21ab" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "rpms-signature-scan", "params": [ { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" }, { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:47b81d6b3d752649eddfbb8b3fd8f6522c4bb07f6d1946f9bc45dae3f92e2c9a" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] }, { "name": "tpa-scan", "params": [ { "name": "image-digest", "value": "$(tasks.build-image-index.results.IMAGE_DIGEST)" }, { "name": "image-url", "value": "$(tasks.build-image-index.results.IMAGE_URL)" } ], "runAfter": [ "build-image-index" ], "taskRef": { "params": [ { "name": "name", "value": "tpa-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "when": [ { "input": "false", "operator": "in", "values": [ "false" ] } ] } ], "workspaces": [ { "name": "git-auth", "optional": true }, { "name": "netrc", "optional": true } ] }, "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "results": [ { "name": "IMAGE_URL", "value": "quay.io/rhtap_qe/default-tenant/tsf-demo-comp:5f0838507251d833df91ef169fe5c63e3c62ea0f" }, { "name": "IMAGE_DIGEST", "value": "sha256:37bd3ef5f28298e117a077124696c0db64da1a5fca1596b80e10f4d4cbab328a" }, { "name": "CHAINS-GIT_URL", "value": "https://github.com/rhads-tsf-qe/testrepo" }, { "name": "CHAINS-GIT_COMMIT", "value": "5f0838507251d833df91ef169fe5c63e3c62ea0f" } ], "startTime": "2026-04-24T07:42:35Z" } } ], "kind": "List", "metadata": { "resourceVersion": "" } }