From e06d1a90435fec9a4a8d1e213efd12c18e5a98dc Mon Sep 17 00:00:00 2001 From: serverless-qe Date: Thu, 12 Nov 2026 09:35:22 +0000 Subject: [PATCH] [release-v1.17] Sync Konflux configurations --- .tekton/docker-build.yaml | 198 ++++++++---------- .../net-kourier-kourier-117-pull-request.yaml | 2 + .tekton/net-kourier-kourier-117-push.yaml | 8 + 3 files changed, 101 insertions(+), 107 deletions(-) diff --git a/.tekton/docker-build.yaml b/.tekton/docker-build.yaml index f4407ba3c..9c8a86337 100755 --- a/.tekton/docker-build.yaml +++ b/.tekton/docker-build.yaml @@ -13,27 +13,6 @@ spec: _Uses `buildah` to create a multi-platform container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. This pipeline requires that the [multi platform controller](https://github.com/konflux-ci/multi-platform-controller) is deployed and configured on your Konflux instance. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-multi-platform-oci-ta?tab=tags)_ params: - - default: - - linux/x86_64 - - linux/arm64 - - linux/ppc64le - - linux/s390x - description: List of platforms to build the container images on. The available - set of values is determined by the configuration of the multi-platform-controller. - name: build-platforms - type: array - - default: --all-projects --org=3e1a4cca-ebfb-495f-b64c-3cc960d566b4 --exclude=test*,vendor,third_party - description: Append arguments to Snyk code command. - name: snyk-args - type: string - - default: "true" - description: Build a source image. - name: build-source-image - type: string - - default: "false" - description: 'Enable in-development package managers. WARNING: the behavior may - change at any time without notice. Use at your own risk.' - name: prefetch-input-dev-package-managers - default: [] description: Additional image tags name: additional-tags @@ -75,6 +54,10 @@ spec: 2d, 3w for hours, days, and weeks, respectively. name: image-expires-after type: string + - default: "false" + description: Build a source image. + name: build-source-image + type: string - default: "true" description: Add built image into an OCI image index name: build-image-index @@ -124,6 +107,12 @@ spec: etc.) from the resulting image. name: omit-history type: string + - default: + - linux/x86_64 + description: List of platforms to build the container images on. The available + set of values is determined by the configuration of the multi-platform-controller. + name: build-platforms + type: array results: - description: "" name: IMAGE_URL @@ -138,92 +127,6 @@ spec: name: CHAINS-GIT_COMMIT value: $(tasks.clone-repository.results.commit) tasks: - - matrix: - params: - - name: image-platform - value: - - $(params.build-platforms) - name: roxctl-scan - params: - - name: image-digest - value: $(tasks.build-image-index.results.IMAGE_DIGEST) - - name: image-url - value: $(tasks.build-image-index.results.IMAGE_URL) - runAfter: - - build-image-index - taskRef: - params: - - name: name - value: roxctl-scan - - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-roxctl-scan:0.2@sha256:78e49dd18ed8e438d28cbd27e7d93f98b3dab35dd77df7930810b747c6033d6e - - name: kind - value: task - resolver: bundles - timeout: 20m - when: - - input: $(params.skip-checks) - operator: in - values: - - "false" - - name: sast-snyk-check - params: - - name: ARGS - value: $(params.snyk-args) - - name: image-digest - value: $(tasks.build-image-index.results.IMAGE_DIGEST) - - name: image-url - value: $(tasks.build-image-index.results.IMAGE_URL) - - name: TARGET_DIRS - value: $(params.sast-target-dirs) - - name: SOURCE_ARTIFACT - value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - runAfter: - - build-image-index - taskRef: - params: - - name: name - value: sast-snyk-check-oci-ta - - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5.1@sha256:53443febc3a87ea6d4baacffc70d6f7dbdd1b4e69e0852337661097c73433519 - - name: kind - value: task - resolver: bundles - when: - - input: $(params.skip-checks) - operator: in - values: - - "false" - - name: prefetch-dependencies - params: - - name: dev-package-managers - value: $(params.prefetch-input-dev-package-managers) - - name: input - value: $(params.prefetch-input) - - name: enable-package-registry-proxy - value: $(params.enable-package-registry-proxy) - - name: SOURCE_ARTIFACT - value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) - - name: ociStorage - value: $(params.output-image).prefetch - - name: ociArtifactExpiresAfter - value: $(params.image-expires-after) - runAfter: - - clone-repository - taskRef: - params: - - name: name - value: prefetch-dependencies-oci-ta - - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.11.0@sha256:3839c8468b08b3aab55f4cc92e645ad275012f8ef8235a504aca397121a9e7da - - name: kind - value: task - resolver: bundles - workspaces: - - name: git-basic-auth - workspace: git-auth - - name: netrc - workspace: netrc - name: apply-tags params: - name: ADDITIONAL_TAGS @@ -280,6 +183,34 @@ spec: workspaces: - name: basic-auth workspace: git-auth + - name: prefetch-dependencies + params: + - name: input + value: $(params.prefetch-input) + - name: enable-package-registry-proxy + value: $(params.enable-package-registry-proxy) + - name: SOURCE_ARTIFACT + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + - name: ociStorage + value: $(params.output-image).prefetch + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - clone-repository + taskRef: + params: + - name: name + value: prefetch-dependencies-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.11.0@sha256:3839c8468b08b3aab55f4cc92e645ad275012f8ef8235a504aca397121a9e7da + - name: kind + value: task + resolver: bundles + workspaces: + - name: git-basic-auth + workspace: git-auth + - name: netrc + workspace: netrc - matrix: params: - name: PLATFORM @@ -410,6 +341,33 @@ spec: operator: in values: - "false" + - matrix: + params: + - name: image-platform + value: + - $(params.build-platforms) + name: roxctl-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: roxctl-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-roxctl-scan:0.2@sha256:78e49dd18ed8e438d28cbd27e7d93f98b3dab35dd77df7930810b747c6033d6e + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" - matrix: params: - name: platform @@ -435,6 +393,32 @@ spec: operator: in values: - "false" + - name: sast-snyk-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-snyk-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5.1@sha256:53443febc3a87ea6d4baacffc70d6f7dbdd1b4e69e0852337661097c73433519 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" - matrix: params: - name: image-arch diff --git a/.tekton/net-kourier-kourier-117-pull-request.yaml b/.tekton/net-kourier-kourier-117-pull-request.yaml index 033a6a0bf..721eaf747 100755 --- a/.tekton/net-kourier-kourier-117-pull-request.yaml +++ b/.tekton/net-kourier-kourier-117-pull-request.yaml @@ -33,6 +33,8 @@ spec: value: '{{source_url}}' - name: hermetic value: "true" + - name: build-source-image + value: "true" - name: image-expires-after value: 5d - name: output-image diff --git a/.tekton/net-kourier-kourier-117-push.yaml b/.tekton/net-kourier-kourier-117-push.yaml index 64ca057d3..67937f6ef 100755 --- a/.tekton/net-kourier-kourier-117-push.yaml +++ b/.tekton/net-kourier-kourier-117-push.yaml @@ -32,8 +32,16 @@ spec: value: '{{source_url}}' - name: hermetic value: "true" + - name: build-source-image + value: "true" - name: output-image value: quay.io/redhat-user-workloads/ocp-serverless-tenant/serverless-operator-137/net-kourier-kourier:{{revision}} + - name: build-platforms + value: + - linux/x86_64 + - linux/arm64 + - linux/ppc64le + - linux/s390x - name: revision value: '{{revision}}' - name: additional-tags