Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
75 changes: 52 additions & 23 deletions .tekton/scanner-component-pipeline.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,22 @@ apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
name: scanner-component-pipeline

spec:

finally:

- name: slack-notification
params:
- name: message
value: ':x: `{{event_type}}` pipeline for <https://console.redhat.com/application-pipeline/workspaces/rh-acs/applications/acs/pipelineruns/$(context.pipelineRun.name)|$(context.pipelineRun.name)> (`$(params.output-image-repo)`, revision <$(params.git-url)/commit/$(params.revision)|$(params.revision)>) has failed.'
- name: key-name
value: 'acs-konflux-notifications'
when:
# Run when any task has Failed
# Run when any task has Failed
- input: $(tasks.status)
operator: in
values: ["Failed"]
values: [ "Failed" ]
taskRef:
params:
- name: name
Expand All @@ -24,6 +27,7 @@ spec:
- name: kind
value: task
resolver: bundles

- name: show-sbom
params:
- name: IMAGE_URL
Expand All @@ -37,6 +41,7 @@ spec:
- name: kind
value: task
resolver: bundles

- name: post-metric-end
params:
- name: AGGREGATE_TASKS_STATUS
Expand All @@ -50,6 +55,7 @@ spec:
- name: kind
value: task
resolver: bundles

params:
- description: Source Repository URL
name: git-url
Expand Down Expand Up @@ -108,7 +114,7 @@ spec:
description: Build stage to target in container build
name: build-target-stage
type: string
- default: []
- default: [ ]
description: List of scanner-data file names to fetch to include in the container build.
name: blobs-to-fetch
type: array
Expand All @@ -134,6 +140,7 @@ spec:
- name: extra-labels
type: array
description: Additional labels to put on the built containers.

results:
- description: ""
name: IMAGE_URL
Expand All @@ -147,17 +154,21 @@ spec:
- description: ""
name: CHAINS-GIT_COMMIT
value: $(tasks.clone-repository.results.commit)

workspaces:
- name: git-auth

tasks:

- name: post-metric-start
taskRef: *post-bigquery-metrics-ref

- name: init
params:
- name: image-url
# We can't provide a StackRox-style tag because it is not known at this time (requires cloning source, etc.)
# As a workaround, we still provide a unique tag that's based on a revision in order for this task to comply with
# its expected input. We later actually add this tag on a built image with the apply-index-image-tag task.
# We can't provide a StackRox-style tag because it is not known at this time (requires cloning source, etc.)
# As a workaround, we still provide a unique tag that's based on a revision in order for this task to comply with
# its expected input. We later actually add this tag on a built image with the apply-index-image-tag task.
value: $(params.output-image-repo):konflux-$(params.revision)
- name: rebuild
value: $(params.rebuild)
Expand All @@ -172,6 +183,7 @@ spec:
- name: kind
value: task
resolver: bundles

- name: clone-repository
params:
- name: url
Expand All @@ -198,10 +210,11 @@ spec:
when:
- input: $(tasks.init.results.build)
operator: in
values: ["true"]
values: [ "true" ]
workspaces:
- name: basic-auth
workspace: git-auth

- name: determine-image-expiration
params:
- name: DEFAULT_IMAGE_EXPIRES_AFTER
Expand All @@ -217,6 +230,7 @@ spec:
- name: kind
value: task
resolver: bundles

- name: determine-image-tag
params:
- name: TAG_SUFFIX
Expand All @@ -232,10 +246,11 @@ spec:
- name: kind
value: task
resolver: bundles

- name: fetch-scanner-data
params:
- name: BLOBS_TO_FETCH
value: ["$(params.blobs-to-fetch[*])"]
value: [ "$(params.blobs-to-fetch[*])" ]
- name: TARGET_DIR
value: .konflux/scanner-data
- name: SOURCE_ARTIFACT
Expand All @@ -253,6 +268,7 @@ spec:
- name: kind
value: task
resolver: bundles

- name: prefetch-dependencies
params:
- name: input
Expand All @@ -265,7 +281,7 @@ spec:
value: $(params.oci-artifact-expires-after)
- name: ACTIVATION_KEY
value: subscription-manager-activation-key-prod
# Required for RPM prefetching support
# Required for RPM prefetching support
- name: dev-package-managers
value: "true"
taskRef:
Expand All @@ -280,6 +296,7 @@ spec:
workspaces:
- name: git-basic-auth
workspace: git-auth

- name: build-images
matrix:
params:
Expand Down Expand Up @@ -315,7 +332,7 @@ spec:
- name: BUILDAH_FORMAT
value: $(params.buildah-format)
- name: LABELS
value: ["$(params.extra-labels[*])"]
value: [ "$(params.extra-labels[*])" ]
- name: BUILD_TIMESTAMP
value: "$(tasks.clone-repository.results.commit-timestamp)"
taskRef:
Expand All @@ -330,7 +347,8 @@ spec:
when:
- input: $(tasks.init.results.build)
operator: in
values: ["true"]
values: [ "true" ]

- name: build-image-index
params:
- name: IMAGE
Expand All @@ -357,7 +375,8 @@ spec:
when:
- input: $(tasks.init.results.build)
operator: in
values: ["true"]
values: [ "true" ]

- name: apply-index-image-tag
params:
- name: IMAGE_URL
Expand All @@ -379,7 +398,8 @@ spec:
when:
- input: $(tasks.init.results.build)
operator: in
values: ["true"]
values: [ "true" ]

- name: build-source-image
params:
- name: BINARY_IMAGE
Expand All @@ -402,10 +422,11 @@ spec:
when:
- input: $(tasks.init.results.build)
operator: in
values: ["true"]
values: [ "true" ]
- input: $(params.build-source-image)
operator: in
values: ["true"]
values: [ "true" ]

- name: deprecated-base-image-check
params:
- name: IMAGE_URL
Expand All @@ -424,7 +445,8 @@ spec:
when:
- input: $(params.skip-checks)
operator: in
values: ["false"]
values: [ "false" ]

- name: clair-scan
matrix:
params:
Expand All @@ -448,7 +470,8 @@ spec:
when:
- input: $(params.skip-checks)
operator: in
values: ["false"]
values: [ "false" ]

- name: ecosystem-cert-preflight-checks
matrix:
params:
Expand All @@ -470,7 +493,8 @@ spec:
when:
- input: $(params.skip-checks)
operator: in
values: ["false"]
values: [ "false" ]

- name: sast-shell-check
params:
- name: image-digest
Expand All @@ -493,7 +517,8 @@ spec:
when:
- input: $(params.skip-checks)
operator: in
values: ["false"]
values: [ "false" ]

- name: sast-unicode-check
params:
- name: image-digest
Expand All @@ -516,7 +541,8 @@ spec:
when:
- input: $(params.skip-checks)
operator: in
values: ["false"]
values: [ "false" ]

- name: sast-snyk-check
params:
- name: SOURCE_ARTIFACT
Expand All @@ -539,7 +565,8 @@ spec:
when:
- input: $(params.skip-checks)
operator: in
values: ["false"]
values: [ "false" ]

- name: clamav-scan
matrix:
params:
Expand All @@ -563,7 +590,8 @@ spec:
when:
- input: $(params.skip-checks)
operator: in
values: ["false"]
values: [ "false" ]

- name: rpms-signature-scan
params:
- name: image-digest
Expand All @@ -582,7 +610,8 @@ spec:
when:
- input: $(params.skip-checks)
operator: in
values: ["false"]
values: [ "false" ]

- name: push-dockerfile
params:
- name: IMAGE
Expand Down