diff --git a/.tekton/checks.yaml b/.tekton/checks.yaml index bafa40b1..43a04da8 100644 --- a/.tekton/checks.yaml +++ b/.tekton/checks.yaml @@ -77,7 +77,7 @@ spec: - name: name value: git-clone-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2@sha256:e5ba1f8549e6a0f043629ef00bea7511957121e05304b688f40ff12304560f38 + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.5@sha256:799e6093832d194293168240a6e2209479cfaad33de51d57bfcbcfead97ed038 - name: kind value: task resolver: bundles diff --git a/.tekton/operator-index-pipeline.yaml b/.tekton/operator-index-pipeline.yaml index b45fdcf2..eba4c1eb 100644 --- a/.tekton/operator-index-pipeline.yaml +++ b/.tekton/operator-index-pipeline.yaml @@ -2,17 +2,13 @@ apiVersion: tekton.dev/v1 kind: Pipeline metadata: name: operator-index-pipeline - spec: - description: | This pipeline builds and verifies ACS operator [file-based catalogs](https://konflux-ci.dev/docs/advanced-how-tos/building-olm.adoc#building-the-file-based-catalog). Modified from the generic Konflux pipeline by adding an OpenShift version parameter. _Uses `buildah` to create a container image. Its build-time tests are limited to verifying the included catalog and do not scan the image._ - finally: - - name: slack-notification params: - name: message @@ -20,7 +16,7 @@ spec: - name: key-name value: 'acs-konflux-notifications' when: - # Run when any task has Failed + # Run when any task has Failed - input: $(tasks.status) operator: in values: ["Failed"] @@ -33,41 +29,6 @@ spec: - name: kind value: task resolver: bundles - - - name: show-sbom - params: - - name: IMAGE_URL - value: $(tasks.build-image-index.results.IMAGE_URL) - taskRef: - params: - - name: name - value: show-sbom - - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:8fe70a95c28b1ac92abd67a7477ad960218f3f570a9f8a12ad082dff7e9c9579 - - name: kind - value: task - resolver: bundles - - - name: show-summary - params: - - name: pipelinerun-name - value: $(context.pipelineRun.name) - - name: git-url - value: $(tasks.clone-repository.results.url)?rev=$(tasks.clone-repository.results.commit) - - name: image-url - value: $(params.output-image-repo):$(params.output-image-tag) - - name: build-task-status - value: $(tasks.build-image-index.status) - taskRef: - params: - - name: name - value: summary - - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-summary:0.2@sha256:62c465f052e15b8236aec09cc66710896e60386ea7b35c4888bb8273ff655b77 - - name: kind - value: task - resolver: bundles - - name: post-metric-end params: - name: AGGREGATE_TASKS_STATUS @@ -81,7 +42,6 @@ spec: - name: kind value: task resolver: bundles - params: - description: Source Repository URL name: git-url @@ -125,9 +85,9 @@ spec: type: string - description: Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively. name: image-expires-after - # Image expiry disabled because it sets quay.expires-after label on the image which fails Conforma at release time. - # A downside is that FBC images will stay in our Quay forever while certainly they become unneeded as time passes. - # TODO(ROX-27836): find a way to garbage-collect FBC images. + # Image expiry disabled because it sets quay.expires-after label on the image which fails Conforma at release time. + # A downside is that FBC images will stay in our Quay forever while certainly they become unneeded as time passes. + # TODO(ROX-27836): find a way to garbage-collect FBC images. default: '' - default: "false" description: Build a source image. @@ -157,7 +117,18 @@ spec: default: 'false' description: Enable cache proxy configuration type: string - + - name: source-date-epoch + type: string + default: '' + description: Sets the image created time and the SOURCE_DATE_EPOCH build argument. On its own, it does not change file timestamps inside the layers (set rewrite-timestamp to "true" for that). Leave empty to keep the actual build time. + - name: rewrite-timestamp + type: string + default: 'false' + description: When "true", clamp file modification times in the image layers to at most source-date-epoch. Does nothing unless source-date-epoch is set. + - name: omit-history + type: string + default: 'false' + description: When "true", omit the build history (history timestamps, layer metadata, etc.) from the resulting image. results: - description: "" name: IMAGE_URL @@ -171,15 +142,12 @@ spec: - description: "" name: CHAINS-GIT_COMMIT value: $(tasks.clone-repository.results.commit) - workspaces: - name: git-auth - tasks: - - name: post-metric-start taskRef: *post-bigquery-metrics-ref - + params: [] - name: init params: - name: enable-cache-proxy @@ -189,11 +157,10 @@ spec: - name: name value: init - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08 + value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:15d3d4a7e5c70b068103a9d4c6ba2e049db8896709fc45c0bd4be49c134b0989 - name: kind value: task resolver: bundles - - name: clone-repository params: - name: url @@ -209,14 +176,13 @@ spec: - name: name value: git-clone-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2@sha256:e5ba1f8549e6a0f043629ef00bea7511957121e05304b688f40ff12304560f38 + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.5@sha256:799e6093832d194293168240a6e2209479cfaad33de51d57bfcbcfead97ed038 - name: kind value: task resolver: bundles workspaces: - name: basic-auth workspace: git-auth - - name: build-images matrix: params: @@ -241,7 +207,7 @@ spec: - base_image=$(params.base-image) - catalog_dir=$(params.catalog-dir) - name: SOURCE_ARTIFACT - value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + value: $(tasks.fbc-inject-lifecycle.results.SOURCE_ARTIFACT) - name: IMAGE_APPEND_PLATFORM value: "true" - name: BUILDAH_FORMAT @@ -250,17 +216,23 @@ spec: value: $(tasks.init.results.http-proxy) - name: NO_PROXY value: $(tasks.init.results.no-proxy) + - name: SOURCE_DATE_EPOCH + value: $(params.source-date-epoch) + - name: REWRITE_TIMESTAMP + value: $(params.rewrite-timestamp) + - name: OMIT_HISTORY + value: $(params.omit-history) taskRef: params: - name: name value: buildah-remote-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.10@sha256:c77892be9e7217b9baa9abdbaf432c16ee49c30601b6b25cfbc9d704295c58ef + value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.11.0@sha256:78529bcd4a665aad693af8b98b2fed223a0b853c4f0cf3a8620eebdd66f517ea - name: kind value: task resolver: bundles retries: 1 - + runAfter: [] - name: build-image-index params: - name: IMAGE @@ -277,12 +249,11 @@ spec: - name: name value: build-image-index - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:70c52e88e737340e7b58418fda38c13273aa7cdf587b825778e3560aca1d1133 + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:b00c9e68e96d41c95c725805e378ccdda44e0a1e55b69eae3f9d1f0ba1a6a493 - name: kind value: task resolver: bundles - runAfter: [ build-images ] - + runAfter: [build-images] - name: deprecated-base-image-check params: - name: IMAGE_URL @@ -294,7 +265,7 @@ spec: - name: name value: deprecated-image-check - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e + value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872 - name: kind value: task resolver: bundles @@ -302,7 +273,6 @@ spec: - input: $(params.skip-checks) operator: in values: ["false"] - - name: apply-tags params: - name: IMAGE_URL @@ -314,11 +284,10 @@ spec: - name: name value: apply-tags - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6 + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:da0cff2a36f07087798cd5f577b15f3d9e6dd4d3d08956227b298362e08ecc37 - name: kind value: task resolver: bundles - - name: validate-fbc params: - name: IMAGE_URL @@ -330,7 +299,7 @@ spec: - name: name value: validate-fbc - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-validate-fbc:0.1@sha256:855ac0d3e01755cfcc9854d4e47fed2a655fd7ca259adf4e403ab5b658333313 + value: quay.io/konflux-ci/tekton-catalog/task-validate-fbc:0.3@sha256:5ac2ab06fa8b7b7dfaa7a57cf68d3dd8de3fa9c7d6ebaef17626509c45f234a3 - name: kind value: task resolver: bundles @@ -338,7 +307,6 @@ spec: - input: $(params.skip-checks) operator: in values: ["false"] - - name: fbc-target-index-pruning-check params: - name: IMAGE_URL @@ -362,7 +330,6 @@ spec: - input: $(params.skip-checks) operator: in values: ["false"] - - name: fbc-fips-check-oci-ta params: - name: image-digest @@ -370,13 +337,13 @@ spec: - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) - name: SOURCE_ARTIFACT - value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + value: $(tasks.fbc-inject-lifecycle.results.SOURCE_ARTIFACT) taskRef: params: - name: name value: fbc-fips-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-fbc-fips-check-oci-ta:0.1@sha256:935adb61a5c9be0f619edc8838771ad3fe08cf17689094aeaaeac493af2a2115 + value: quay.io/konflux-ci/tekton-catalog/task-fbc-fips-check-oci-ta:0.1@sha256:11f4adee71143d1bb8504bb96edfa868be9624e0f1758fc299d7a9a86f30e8e0 - name: kind value: task resolver: bundles @@ -384,3 +351,27 @@ spec: - input: $(params.skip-checks) operator: in values: ["false"] + runAfter: [] + - name: fbc-inject-lifecycle + taskRef: + resolver: bundles + params: + - name: kind + value: task + - name: name + value: fbc-inject-lifecycle-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-fbc-inject-lifecycle-oci-ta:0.1@sha256:da1217be1dcec3d5b5140ea351466607005481397b31f2b81108c4fd3012fbde + params: + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: SOURCE_ARTIFACT + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + - name: ociStorage + value: $(params.output-image).lifecycle + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - clone-repository diff --git a/.tekton/ready-for-master-merge.yaml b/.tekton/ready-for-master-merge.yaml index 6cba40fa..03ea16b9 100644 --- a/.tekton/ready-for-master-merge.yaml +++ b/.tekton/ready-for-master-merge.yaml @@ -78,7 +78,7 @@ spec: - name: name value: git-clone-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2@sha256:e5ba1f8549e6a0f043629ef00bea7511957121e05304b688f40ff12304560f38 + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.5@sha256:799e6093832d194293168240a6e2209479cfaad33de51d57bfcbcfead97ed038 - name: kind value: task resolver: bundles