|
| 1 | +apiVersion: tekton.dev/v1 |
| 2 | +kind: PipelineRun |
| 3 | +metadata: |
| 4 | + annotations: |
| 5 | + build.appstudio.openshift.io/repo: https://github.com/openshift/cert-manager-operator-release?rev={{revision}} |
| 6 | + build.appstudio.redhat.com/commit_sha: '{{revision}}' |
| 7 | + build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' |
| 8 | + build.appstudio.redhat.com/target_branch: '{{target_branch}}' |
| 9 | + pipelinesascode.tekton.dev/cancel-in-progress: "true" |
| 10 | + pipelinesascode.tekton.dev/max-keep-runs: "3" |
| 11 | + pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch |
| 12 | + == "main" && ( "./catalogs/v4.17/***".pathChanged() || ".tekton/cert-manager-operator-index-4-17-pull-request.yaml".pathChanged() |
| 13 | + || "Containerfile".pathChanged() ) |
| 14 | + creationTimestamp: null |
| 15 | + labels: |
| 16 | + appstudio.openshift.io/application: cert-manager-operator-index-4-17 |
| 17 | + appstudio.openshift.io/component: cert-manager-operator-index-4-17 |
| 18 | + pipelines.appstudio.openshift.io/type: build |
| 19 | + name: cert-manager-operator-index-4-17-on-pull-request |
| 20 | + namespace: cert-manager-oape-tenant |
| 21 | +spec: |
| 22 | + params: |
| 23 | + - name: git-url |
| 24 | + value: '{{source_url}}' |
| 25 | + - name: revision |
| 26 | + value: '{{revision}}' |
| 27 | + - name: output-image |
| 28 | + value: quay.io/redhat-user-workloads/cert-manager-oape-tenant/cert-manager-operator-4-17/cert-manager-operator-index-4-17:on-pr-{{revision}} |
| 29 | + - name: image-expires-after |
| 30 | + value: 5d |
| 31 | + - name: build-platforms |
| 32 | + value: |
| 33 | + - linux/x86_64 |
| 34 | + - name: dockerfile |
| 35 | + value: Containerfile |
| 36 | + - name: path-context |
| 37 | + value: catalogs/v4.17 |
| 38 | + pipelineSpec: |
| 39 | + description: | |
| 40 | + This pipeline is ideal for building and verifying [file-based catalogs](https://konflux-ci.dev/docs/end-to-end/building-olm/#building-the-file-based-catalog). |
| 41 | +
|
| 42 | + _Uses `buildah` to create a container image. Its build-time tests are limited to verifying the included catalog and do not scan the image. |
| 43 | + This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-fbc-builder?tab=tags)_ |
| 44 | + finally: |
| 45 | + - name: show-sbom |
| 46 | + params: |
| 47 | + - name: IMAGE_URL |
| 48 | + value: $(tasks.build-image-index.results.IMAGE_URL) |
| 49 | + taskRef: |
| 50 | + params: |
| 51 | + - name: name |
| 52 | + value: show-sbom |
| 53 | + - name: bundle |
| 54 | + value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:04f15cbce548e1db7770eee3f155ccb2cc0140a6c371dc67e9a34d83673ea0c0 |
| 55 | + - name: kind |
| 56 | + value: task |
| 57 | + resolver: bundles |
| 58 | + params: |
| 59 | + - description: Source Repository URL |
| 60 | + name: git-url |
| 61 | + type: string |
| 62 | + - default: "" |
| 63 | + description: Revision of the Source Repository |
| 64 | + name: revision |
| 65 | + type: string |
| 66 | + - description: Fully Qualified Output Image |
| 67 | + name: output-image |
| 68 | + type: string |
| 69 | + - default: . |
| 70 | + description: Path to the source code of an application's component from where |
| 71 | + to build image. |
| 72 | + name: path-context |
| 73 | + type: string |
| 74 | + - default: Dockerfile |
| 75 | + description: Path to the Dockerfile inside the context specified by parameter |
| 76 | + path-context |
| 77 | + name: dockerfile |
| 78 | + type: string |
| 79 | + - default: "false" |
| 80 | + description: Force rebuild image |
| 81 | + name: rebuild |
| 82 | + type: string |
| 83 | + - default: "false" |
| 84 | + description: Skip checks against built image |
| 85 | + name: skip-checks |
| 86 | + type: string |
| 87 | + - default: "true" |
| 88 | + description: Execute the build with network isolation |
| 89 | + name: hermetic |
| 90 | + type: string |
| 91 | + - default: "" |
| 92 | + description: Build dependencies to be prefetched by Cachi2 |
| 93 | + name: prefetch-input |
| 94 | + type: string |
| 95 | + - default: "" |
| 96 | + description: Image tag expiration time, time values could be something like |
| 97 | + 1h, 2d, 3w for hours, days, and weeks, respectively. |
| 98 | + name: image-expires-after |
| 99 | + - default: "false" |
| 100 | + description: Build a source image. |
| 101 | + name: build-source-image |
| 102 | + type: string |
| 103 | + - default: "true" |
| 104 | + description: Add built image into an OCI image index |
| 105 | + name: build-image-index |
| 106 | + type: string |
| 107 | + - default: [] |
| 108 | + description: Array of --build-arg values ("arg=value" strings) for buildah |
| 109 | + name: build-args |
| 110 | + type: array |
| 111 | + - default: "" |
| 112 | + description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file |
| 113 | + name: build-args-file |
| 114 | + type: string |
| 115 | + - default: |
| 116 | + - linux/x86_64 |
| 117 | + description: List of platforms to build the container images on. The available |
| 118 | + set of values is determined by the configuration of the multi-platform-controller. |
| 119 | + name: build-platforms |
| 120 | + type: array |
| 121 | + results: |
| 122 | + - description: "" |
| 123 | + name: IMAGE_URL |
| 124 | + value: $(tasks.build-image-index.results.IMAGE_URL) |
| 125 | + - description: "" |
| 126 | + name: IMAGE_DIGEST |
| 127 | + value: $(tasks.build-image-index.results.IMAGE_DIGEST) |
| 128 | + - description: "" |
| 129 | + name: CHAINS-GIT_URL |
| 130 | + value: $(tasks.clone-repository.results.url) |
| 131 | + - description: "" |
| 132 | + name: CHAINS-GIT_COMMIT |
| 133 | + value: $(tasks.clone-repository.results.commit) |
| 134 | + tasks: |
| 135 | + - name: init |
| 136 | + params: |
| 137 | + - name: image-url |
| 138 | + value: $(params.output-image) |
| 139 | + - name: rebuild |
| 140 | + value: $(params.rebuild) |
| 141 | + - name: skip-checks |
| 142 | + value: $(params.skip-checks) |
| 143 | + taskRef: |
| 144 | + params: |
| 145 | + - name: name |
| 146 | + value: init |
| 147 | + - name: bundle |
| 148 | + value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:db1285c571d7037684876df0a5b619305b3c8f2be88233ebead4d37caf5cb04b |
| 149 | + - name: kind |
| 150 | + value: task |
| 151 | + resolver: bundles |
| 152 | + - name: clone-repository |
| 153 | + params: |
| 154 | + - name: url |
| 155 | + value: $(params.git-url) |
| 156 | + - name: revision |
| 157 | + value: $(params.revision) |
| 158 | + - name: ociStorage |
| 159 | + value: $(params.output-image).git |
| 160 | + - name: ociArtifactExpiresAfter |
| 161 | + value: $(params.image-expires-after) |
| 162 | + runAfter: |
| 163 | + - init |
| 164 | + taskRef: |
| 165 | + params: |
| 166 | + - name: name |
| 167 | + value: git-clone-oci-ta |
| 168 | + - name: bundle |
| 169 | + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:9709088bf3c581d4763e9804d9ee3a1f06ad6a61c23237277057c4f0cdc4f9c3 |
| 170 | + - name: kind |
| 171 | + value: task |
| 172 | + resolver: bundles |
| 173 | + when: |
| 174 | + - input: $(tasks.init.results.build) |
| 175 | + operator: in |
| 176 | + values: |
| 177 | + - "true" |
| 178 | + workspaces: |
| 179 | + - name: basic-auth |
| 180 | + workspace: git-auth |
| 181 | + - name: prefetch-dependencies |
| 182 | + params: |
| 183 | + - name: input |
| 184 | + value: $(params.prefetch-input) |
| 185 | + - name: SOURCE_ARTIFACT |
| 186 | + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) |
| 187 | + - name: ociStorage |
| 188 | + value: $(params.output-image).prefetch |
| 189 | + - name: ociArtifactExpiresAfter |
| 190 | + value: $(params.image-expires-after) |
| 191 | + runAfter: |
| 192 | + - clone-repository |
| 193 | + taskRef: |
| 194 | + params: |
| 195 | + - name: name |
| 196 | + value: prefetch-dependencies-oci-ta |
| 197 | + - name: bundle |
| 198 | + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.2@sha256:efc8aebec295bf5986597b6bbeebe093b2764fea79c66094e05ff3d283f54932 |
| 199 | + - name: kind |
| 200 | + value: task |
| 201 | + resolver: bundles |
| 202 | + workspaces: |
| 203 | + - name: git-basic-auth |
| 204 | + workspace: git-auth |
| 205 | + - name: netrc |
| 206 | + workspace: netrc |
| 207 | + - matrix: |
| 208 | + params: |
| 209 | + - name: PLATFORM |
| 210 | + value: |
| 211 | + - $(params.build-platforms) |
| 212 | + name: build-images |
| 213 | + params: |
| 214 | + - name: IMAGE |
| 215 | + value: $(params.output-image) |
| 216 | + - name: DOCKERFILE |
| 217 | + value: $(params.dockerfile) |
| 218 | + - name: CONTEXT |
| 219 | + value: $(params.path-context) |
| 220 | + - name: HERMETIC |
| 221 | + value: $(params.hermetic) |
| 222 | + - name: PREFETCH_INPUT |
| 223 | + value: $(params.prefetch-input) |
| 224 | + - name: IMAGE_EXPIRES_AFTER |
| 225 | + value: $(params.image-expires-after) |
| 226 | + - name: COMMIT_SHA |
| 227 | + value: $(tasks.clone-repository.results.commit) |
| 228 | + - name: BUILD_ARGS |
| 229 | + value: |
| 230 | + - $(params.build-args[*]) |
| 231 | + - name: BUILD_ARGS_FILE |
| 232 | + value: $(params.build-args-file) |
| 233 | + - name: SOURCE_ARTIFACT |
| 234 | + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) |
| 235 | + - name: CACHI2_ARTIFACT |
| 236 | + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) |
| 237 | + - name: IMAGE_APPEND_PLATFORM |
| 238 | + value: "true" |
| 239 | + runAfter: |
| 240 | + - clone-repository |
| 241 | + taskRef: |
| 242 | + params: |
| 243 | + - name: name |
| 244 | + value: buildah-remote-oci-ta |
| 245 | + - name: bundle |
| 246 | + value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.4@sha256:a65c8d66587dac5ca631c567b9d3cd36fdb1abda497146e3ce56d1fe65e21d77 |
| 247 | + - name: kind |
| 248 | + value: task |
| 249 | + resolver: bundles |
| 250 | + when: |
| 251 | + - input: $(tasks.init.results.build) |
| 252 | + operator: in |
| 253 | + values: |
| 254 | + - "true" |
| 255 | + - name: build-image-index |
| 256 | + params: |
| 257 | + - name: IMAGE |
| 258 | + value: $(params.output-image) |
| 259 | + - name: COMMIT_SHA |
| 260 | + value: $(tasks.clone-repository.results.commit) |
| 261 | + - name: IMAGE_EXPIRES_AFTER |
| 262 | + value: $(params.image-expires-after) |
| 263 | + - name: ALWAYS_BUILD_INDEX |
| 264 | + value: $(params.build-image-index) |
| 265 | + - name: IMAGES |
| 266 | + value: |
| 267 | + - $(tasks.build-images.results.IMAGE_REF[*]) |
| 268 | + runAfter: |
| 269 | + - build-images |
| 270 | + taskRef: |
| 271 | + params: |
| 272 | + - name: name |
| 273 | + value: build-image-index |
| 274 | + - name: bundle |
| 275 | + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:ec1f33e2e358a5beac831685cf69cd63714d519620953cff48af9d74246118b5 |
| 276 | + - name: kind |
| 277 | + value: task |
| 278 | + resolver: bundles |
| 279 | + when: |
| 280 | + - input: $(tasks.init.results.build) |
| 281 | + operator: in |
| 282 | + values: |
| 283 | + - "true" |
| 284 | + - name: deprecated-base-image-check |
| 285 | + params: |
| 286 | + - name: IMAGE_URL |
| 287 | + value: $(tasks.build-image-index.results.IMAGE_URL) |
| 288 | + - name: IMAGE_DIGEST |
| 289 | + value: $(tasks.build-image-index.results.IMAGE_DIGEST) |
| 290 | + runAfter: |
| 291 | + - build-image-index |
| 292 | + taskRef: |
| 293 | + params: |
| 294 | + - name: name |
| 295 | + value: deprecated-image-check |
| 296 | + - name: bundle |
| 297 | + value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:5d63b920b71192906fe4d6c4903f594e6f34c5edcff9d21714a08b5edcfbc667 |
| 298 | + - name: kind |
| 299 | + value: task |
| 300 | + resolver: bundles |
| 301 | + when: |
| 302 | + - input: $(params.skip-checks) |
| 303 | + operator: in |
| 304 | + values: |
| 305 | + - "false" |
| 306 | + - name: apply-tags |
| 307 | + params: |
| 308 | + - name: IMAGE |
| 309 | + value: $(tasks.build-image-index.results.IMAGE_URL) |
| 310 | + runAfter: |
| 311 | + - build-image-index |
| 312 | + taskRef: |
| 313 | + params: |
| 314 | + - name: name |
| 315 | + value: apply-tags |
| 316 | + - name: bundle |
| 317 | + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.1@sha256:1ef12328e89d7cd517e447e6ca331233df0807794cabf6be1046bc8a976b3f35 |
| 318 | + - name: kind |
| 319 | + value: task |
| 320 | + resolver: bundles |
| 321 | + - name: validate-fbc |
| 322 | + params: |
| 323 | + - name: IMAGE_URL |
| 324 | + value: $(tasks.build-image-index.results.IMAGE_URL) |
| 325 | + - name: IMAGE_DIGEST |
| 326 | + value: $(tasks.build-image-index.results.IMAGE_DIGEST) |
| 327 | + runAfter: |
| 328 | + - build-image-index |
| 329 | + taskRef: |
| 330 | + params: |
| 331 | + - name: name |
| 332 | + value: validate-fbc |
| 333 | + - name: bundle |
| 334 | + value: quay.io/konflux-ci/tekton-catalog/task-validate-fbc:0.1@sha256:ecb9fa56b199afef7a39c6311f3d9c25129797d8c3c103770a7133af617768ee |
| 335 | + - name: kind |
| 336 | + value: task |
| 337 | + resolver: bundles |
| 338 | + when: |
| 339 | + - input: $(params.skip-checks) |
| 340 | + operator: in |
| 341 | + values: |
| 342 | + - "false" |
| 343 | + - name: fbc-target-index-pruning-check |
| 344 | + params: |
| 345 | + - name: IMAGE_URL |
| 346 | + value: $(tasks.build-image-index.results.IMAGE_URL) |
| 347 | + - name: IMAGE_DIGEST |
| 348 | + value: $(tasks.build-image-index.results.IMAGE_DIGEST) |
| 349 | + - name: TARGET_INDEX |
| 350 | + value: registry.redhat.io/redhat/redhat-operator-index |
| 351 | + - name: RENDERED_CATALOG_DIGEST |
| 352 | + value: $(tasks.validate-fbc.results.RENDERED_CATALOG_DIGEST) |
| 353 | + runAfter: |
| 354 | + - validate-fbc |
| 355 | + taskRef: |
| 356 | + params: |
| 357 | + - name: name |
| 358 | + value: fbc-target-index-pruning-check |
| 359 | + - name: bundle |
| 360 | + value: quay.io/konflux-ci/tekton-catalog/task-fbc-target-index-pruning-check:0.1@sha256:e83a377233b9ef4d8bcfd4b42d7b00d1bb45bd65bf7eaf06a9676b3c1facb955 |
| 361 | + - name: kind |
| 362 | + value: task |
| 363 | + resolver: bundles |
| 364 | + when: |
| 365 | + - input: $(params.skip-checks) |
| 366 | + operator: in |
| 367 | + values: |
| 368 | + - "false" |
| 369 | + - name: fbc-fips-check-oci-ta |
| 370 | + params: |
| 371 | + - name: image-digest |
| 372 | + value: $(tasks.build-image-index.results.IMAGE_DIGEST) |
| 373 | + - name: image-url |
| 374 | + value: $(tasks.build-image-index.results.IMAGE_URL) |
| 375 | + - name: SOURCE_ARTIFACT |
| 376 | + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) |
| 377 | + runAfter: |
| 378 | + - build-image-index |
| 379 | + taskRef: |
| 380 | + params: |
| 381 | + - name: name |
| 382 | + value: fbc-fips-check-oci-ta |
| 383 | + - name: bundle |
| 384 | + value: quay.io/konflux-ci/tekton-catalog/task-fbc-fips-check-oci-ta:0.1@sha256:c7a6265b875ee3e25183b7eb5d8ab4fc6182c20fe875a47d89d5e92593801270 |
| 385 | + - name: kind |
| 386 | + value: task |
| 387 | + resolver: bundles |
| 388 | + when: |
| 389 | + - input: $(params.skip-checks) |
| 390 | + operator: in |
| 391 | + values: |
| 392 | + - "false" |
| 393 | + workspaces: |
| 394 | + - name: git-auth |
| 395 | + optional: true |
| 396 | + - name: netrc |
| 397 | + optional: true |
| 398 | + taskRunTemplate: {} |
| 399 | + workspaces: |
| 400 | + - name: git-auth |
| 401 | + secret: |
| 402 | + secretName: '{{ git_auth_secret }}' |
| 403 | +status: {} |
![openshift-merge-bot[bot]](https://avatars.githubusercontent.com/in/412865?v=4&size=40){kind=avatar}
0 commit comments