ODC-7422: Add SBOM link and signed badge in PLR details page #13314

karthikjeeyar · 2023-11-08T11:05:53Z

Fixes:

https://issues.redhat.com/browse/ODC-7422

Analysis / Root cause:

UI should surface SBOM information and command to download the sbom. Signed pipelineruns should show the badge next to pipelinerun details page.

Solution Description:

Use taskrun's results to fetch the SBOM information and use the chain's annotation to show the signed badge.

Screen shots / Gifs for design review:

Tooltip on badge hover:

Test setup:

Install openshift pipelines and create the resources listed in this gist
Visit the pipelinerun detail page

Browser conformance:

Chrome
Firefox
Safari
Edge

karthikjeeyar · 2023-11-08T11:06:17Z

/cc @MariaLeonova @jeff-phillips-18 @vikram-raj

jerolimov

Lgtm! Just some missed i18n strings:

frontend/packages/pipelines-plugin/src/components/pipelineruns/PipelineRunDetailsPage.tsx

...s/pipelines-plugin/src/components/pipelineruns/detail-page-tabs/PipelineRunCustomDetails.tsx

vdemeester

Based on https://gist.github.com/karthikjeeyar/d9fe4d12fbbc1d01273c8540b5504d87#file-cve_scan_output_format-yaml-L7, should task.results.format be that generic (application/json) ? Because it's not like we are taking any application/json content, but that json content also need to "comply" to our "contract".
I think that PR is only about the link and the "signed" badge, so that part has no effect, so it's more for another (upcoming or existing ?) PR.

vdemeester · 2023-11-08T11:27:05Z

frontend/packages/pipelines-plugin/src/utils/pipeline-utils.ts

+}
+
+export const getSbomTaskRun = (taskruns: TaskRunKind[]): TaskRunKind =>
+  taskruns?.find(


We don't read task.results.format anywhere do we ?

You are right @vdemeester, we dont use format annotations in this PR, it just surfaces the SBOM link and reads annotations. The output tab PR (in dynamic plugin) will be using all other annotations like format, type etc

The CVE summary is also JSON based, is that part of this PR?

CVE summary on the pipelinerun list page will be on another PR

…details page

jerolimov

As said, it's almost good. Just one thing and one option/question:

...s/pipelines-plugin/src/components/pipelineruns/detail-page-tabs/PipelineRunCustomDetails.tsx

karthikjeeyar · 2023-11-09T05:00:30Z

/test e2e-gcp-console

jerolimov · 2023-11-09T08:58:49Z

@karthikjeeyar to get the jira/valid-reference label 😏

/retitle ODC-7422: Add SBOM link and signed badge in PLR details page

openshift-ci-robot · 2023-11-09T08:58:55Z

@karthikjeeyar: This pull request references ODC-7422 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.15.0" version, but no target version was set.

In response to this:

Fixes:

https://issues.redhat.com/browse/ODC-7422

Analysis / Root cause:

UI should surface SBOM information and command to download the sbom. Signed pipelineruns should show the badge next to pipelinerun details page.

Solution Description:

Use taskrun's results to fetch the SBOM information and use the chain's annotation to show the signed badge.

Screen shots / Gifs for design review:

Tooltip on badge hover:

Test setup:

Install openshift pipelines and create the resources listed in this gist

Visit the pipelinerun detail page

Browser conformance:

Chrome

Firefox

Safari

Edge

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

jerolimov · 2023-11-09T09:00:09Z

/retest

jerolimov

Code lgtm, and it works as expected (as described).

@vdemeester @burrsutter when your comment is resolved we are happy to merge this.

/lgtm

jrichter1 · 2023-11-10T11:28:30Z

/label qe-approved

openshift-ci-robot · 2023-11-10T11:28:37Z

@karthikjeeyar: This pull request references ODC-7422 which is a valid jira issue.

In response to this:

Fixes:

https://issues.redhat.com/browse/ODC-7422

Analysis / Root cause:

UI should surface SBOM information and command to download the sbom. Signed pipelineruns should show the badge next to pipelinerun details page.

Solution Description:

Use taskrun's results to fetch the SBOM information and use the chain's annotation to show the signed badge.

Screen shots / Gifs for design review:

Tooltip on badge hover:

Test setup:

Install openshift pipelines and create the resources listed in this gist

Visit the pipelinerun detail page

Browser conformance:

Chrome

Firefox

Safari

Edge

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sanketpathak · 2023-11-10T12:10:24Z

@karthikjeeyar Will you be adding any e2e tests for the change?

karthikjeeyar · 2023-11-10T13:35:13Z

@sanketpathak I have logged a story to cover e2e tests in separate PR

sanketpathak · 2023-11-10T20:27:13Z

/retest

jerolimov · 2023-11-10T22:53:00Z

Propagate from the epic

/label docs-approved
/label px-approved

openshift-ci · 2023-11-10T22:53:24Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jerolimov, karthikjeeyar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~frontend/packages/pipelines-plugin/OWNERS~~ [jerolimov,karthikjeeyar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2023-11-11T00:23:39Z

@karthikjeeyar: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

This result contains the URL to the OCI artifact that stores the SBOM. It is meant primarily to be consumed by RHDH¹ and ODC². The URL follows the format: registry.io/user/image:sha256-hash.sbom Note that this URL is not meant to be used with cosign, as it automatically resolves it when performing a "cosign download sbom registry.io/user/image:actual-tag". [1] janus-idp/backstage-plugins#988 [2] openshift/console#13314 Signed-off-by: Bruno Pimentel <bpimente@redhat.com>

openshift-ci bot requested review from abhinandan13jan and christianvogt November 8, 2023 11:06

openshift-ci bot added the component/pipelines Related to pipelines-plugin label Nov 8, 2023

openshift-ci bot added kind/i18n Indicates issue or PR relates to internationalization or has content that needs to be translated approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Nov 8, 2023

openshift-ci bot requested review from jeff-phillips-18, MariaLeonova and vikram-raj November 8, 2023 11:06

jerolimov suggested changes Nov 8, 2023

View reviewed changes

vdemeester reviewed Nov 8, 2023

View reviewed changes

feat(sbom-plr-details): Add Sbom link and signed badge in pipeinerun …

fc7ff98

…details page

karthikjeeyar force-pushed the sbom-plr-details branch from 04840f9 to fc7ff98 Compare November 8, 2023 11:40

jerolimov suggested changes Nov 8, 2023

View reviewed changes

...s/pipelines-plugin/src/components/pipelineruns/detail-page-tabs/PipelineRunCustomDetails.tsx Outdated Show resolved Hide resolved

...s/pipelines-plugin/src/components/pipelineruns/detail-page-tabs/PipelineRunCustomDetails.tsx Outdated Show resolved Hide resolved

cleanup: remove dl for each description data

74305d8

openshift-ci bot changed the title ~~feat(sbom-plr-details): Add SBOM link and signed badge in PLR details page~~ ODC-7422: Add SBOM link and signed badge in PLR details page Nov 9, 2023

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Nov 9, 2023

jerolimov approved these changes Nov 9, 2023

View reviewed changes

openshift-ci bot assigned jerolimov Nov 9, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 9, 2023

openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Nov 10, 2023

openshift-ci bot added docs-approved Signifies that Docs has signed off on this PR px-approved Signifies that Product Support has signed off on this PR labels Nov 10, 2023

jerolimov approved these changes Nov 10, 2023

View reviewed changes

openshift-merge-bot bot merged commit ccebf14 into openshift:master Nov 11, 2023
6 checks passed

brunoapimentel mentioned this pull request Mar 12, 2024

docker-build-rhtap: create a new show-sbom task compatible with RHDH redhat-appstudio/build-definitions#876

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ODC-7422: Add SBOM link and signed badge in PLR details page #13314

ODC-7422: Add SBOM link and signed badge in PLR details page #13314

karthikjeeyar commented Nov 8, 2023

karthikjeeyar commented Nov 8, 2023

jerolimov left a comment

vdemeester left a comment

vdemeester Nov 8, 2023

karthikjeeyar Nov 8, 2023 •

edited

burrsutter Nov 8, 2023

karthikjeeyar Nov 8, 2023

jerolimov left a comment

karthikjeeyar commented Nov 9, 2023

jerolimov commented Nov 9, 2023 •

edited by openshift-ci bot

openshift-ci-robot commented Nov 9, 2023 •

edited by openshift-ci bot

jerolimov commented Nov 9, 2023

jerolimov left a comment •

edited

jrichter1 commented Nov 10, 2023

openshift-ci-robot commented Nov 10, 2023 •

edited by openshift-ci bot

sanketpathak commented Nov 10, 2023 •

edited

karthikjeeyar commented Nov 10, 2023

sanketpathak commented Nov 10, 2023

jerolimov commented Nov 10, 2023 •

edited

openshift-ci bot commented Nov 10, 2023

openshift-ci bot commented Nov 11, 2023

ODC-7422: Add SBOM link and signed badge in PLR details page #13314

ODC-7422: Add SBOM link and signed badge in PLR details page #13314

Conversation

karthikjeeyar commented Nov 8, 2023

karthikjeeyar commented Nov 8, 2023

jerolimov left a comment

Choose a reason for hiding this comment

vdemeester left a comment

Choose a reason for hiding this comment

vdemeester Nov 8, 2023

Choose a reason for hiding this comment

karthikjeeyar Nov 8, 2023 • edited

Choose a reason for hiding this comment

burrsutter Nov 8, 2023

Choose a reason for hiding this comment

karthikjeeyar Nov 8, 2023

Choose a reason for hiding this comment

jerolimov left a comment

Choose a reason for hiding this comment

karthikjeeyar commented Nov 9, 2023

jerolimov commented Nov 9, 2023 • edited by openshift-ci bot

openshift-ci-robot commented Nov 9, 2023 • edited by openshift-ci bot

jerolimov commented Nov 9, 2023

jerolimov left a comment • edited

Choose a reason for hiding this comment

jrichter1 commented Nov 10, 2023

openshift-ci-robot commented Nov 10, 2023 • edited by openshift-ci bot

sanketpathak commented Nov 10, 2023 • edited

karthikjeeyar commented Nov 10, 2023

sanketpathak commented Nov 10, 2023

jerolimov commented Nov 10, 2023 • edited

openshift-ci bot commented Nov 10, 2023

openshift-ci bot commented Nov 11, 2023

karthikjeeyar Nov 8, 2023 •

edited

jerolimov commented Nov 9, 2023 •

edited by openshift-ci bot

openshift-ci-robot commented Nov 9, 2023 •

edited by openshift-ci bot

jerolimov left a comment •

edited

openshift-ci-robot commented Nov 10, 2023 •

edited by openshift-ci bot

sanketpathak commented Nov 10, 2023 •

edited

jerolimov commented Nov 10, 2023 •

edited