apiVersion: tekton.dev/v1

kind: Pipeline

metadata:

name: scanner-v4-pipeline

spec:

finally:

- name: slack-notification

params:

- name: message

value: ':x: `{{event_type}}` pipeline for <https://konflux-ui.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/ns/$(context.pipelineRun.namespace)/pipelinerun/$(context.pipelineRun.name)|$(context.pipelineRun.name)> (`$(params.output-image-repo)`, revision <$(params.git-url)/commit/$(params.revision)|$(params.revision)>) has failed.'

- name: key-name

value: 'acs-konflux-notifications'

when:

# Run when any task has Failed

- input: $(tasks.status)

operator: in

values: ["Failed"]

taskRef:

params:

- name: name

value: slack-webhook-notification

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-slack-webhook-notification:0.1@sha256:02842e9c752056c47a409f69ed462cfd38cbd6b15facb796564a610b549222ea

- name: kind

value: task

resolver: bundles

- name: post-metric-end

params:

- name: AGGREGATE_TASKS_STATUS

value: $(tasks.status)

taskRef: &post-bigquery-metrics-ref

params:

- name: name

value: post-bigquery-metrics

- name: bundle

value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510

- name: kind

value: task

resolver: bundles

params:

- description: Source Repository URL

name: git-url

type: string

- default: ""

description: Revision of the Source Repository

name: revision

type: string

- description: Output Image Repository

name: output-image-repo

type: string

- default: "-fast"

description: Suffix that will be appended to the output image tag and embedded in version strings.

name: output-tag-suffix

type: string

- default: .

description: Path to the source code of an application's component from where to build image.

name: path-context

type: string

- default: Dockerfile

description: Path to the Dockerfile inside the context specified by parameter path-context

name: dockerfile

type: string

- default: "false"

description: Skip checks against built image

name: skip-checks

type: string

- default: "false"

description: Execute the build with network isolation

name: hermetic

type: string

- default: ""

description: Build dependencies to be prefetched by Cachi2

name: prefetch-input

type: string

- description: Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.

name: image-expires-after

type: string

- default: "true"

description: Build a source image.

name: build-source-image

type: string

- default: "0"

description: Depth of the git clone in number of commits. Use "1" for shallow clone. Use "0" for deep clone, i.e. to fetch all commits.

name: clone-depth

type: string

- default: "true"

description: Fetch tags with git clone

name: clone-fetch-tags

type: string

- default: "1d"

description: This sets the expiration time for intermediate OCI artifacts produced and used during builds after which they can be garbage collected.

name: oci-artifact-expires-after

type: string

- name: buildah-format

default: docker

type: string

description: The format for the resulting image's mediaType. Valid values are oci or docker.

- name: extra-labels

type: array

description: Additional labels to put on the built containers.

- default:

- linux/amd64

- linux/arm64

- linux/ppc64le

- linux/s390x

description: >

List of platforms to build the container images for. The available

set of values is determined by the configuration of the multi-platform-controller

on the cluster: https://konflux.pages.redhat.com/docs/users/getting-started/multi-platform-builds.html

name: build-platforms

type: array

- name: enable-cache-proxy

default: 'false'

description: Enable cache proxy configuration

type: string

- name: sast-target-dirs

type: string

default: .

description: Target directories to scan with SAST tools. Multiple values should be separated with commas.

- name: enable-package-registry-proxy

default: 'true'

description: Use the package registry proxy when prefetching dependencies

type: string

- name: source-date-epoch

type: string

default: ''

description: Sets the image created time and the SOURCE_DATE_EPOCH build argument. On its own, it does not change file timestamps inside the layers (set rewrite-timestamp to "true" for that). Leave empty to keep the actual build time.

- name: rewrite-timestamp

type: string

default: 'false'

description: When "true", clamp file modification times in the image layers to at most source-date-epoch. Does nothing unless source-date-epoch is set.

- name: omit-history

type: string

default: 'false'

description: When "true", omit the build history (history timestamps, layer metadata, etc.) from the resulting image.

results:

- description: ""

name: IMAGE_URL

value: $(tasks.build-image-index.results.IMAGE_URL)

- description: ""

name: IMAGE_DIGEST

value: $(tasks.build-image-index.results.IMAGE_DIGEST)

- description: ""

name: CHAINS-GIT_URL

value: $(tasks.clone-repository.results.url)

- description: ""

name: CHAINS-GIT_COMMIT

value: $(tasks.clone-repository.results.commit)

workspaces:

- name: git-auth

tasks:

- name: post-metric-start

taskRef: *post-bigquery-metrics-ref

- name: init

params:

- name: enable-cache-proxy

value: $(params.enable-cache-proxy)

taskRef:

params:

- name: name

value: init

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:7854d7babe4136e53e337f6433d952532314433b48bb62b422ddc02700934d85

- name: kind

value: task

resolver: bundles

- name: clone-repository

params:

- name: url

value: $(params.git-url)

- name: revision

value: $(params.revision)

- name: depth

value: $(params.clone-depth)

- name: fetchTags

value: $(params.clone-fetch-tags)

- name: ociStorage

value: $(params.output-image-repo):konflux-$(params.revision).git

- name: ociArtifactExpiresAfter

value: $(params.oci-artifact-expires-after)

taskRef:

params:

- name: name

value: git-clone-oci-ta

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:a3678910c2bf9187a66a96066193cb41046fbb7097160bf2be6a374ed5e49d30

- name: kind

value: task

resolver: bundles

workspaces:

- name: basic-auth

workspace: git-auth

- name: determine-image-expiration

params:

- name: DEFAULT_IMAGE_EXPIRES_AFTER

value: $(params.image-expires-after)

- name: SOURCE_ARTIFACT

value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)

taskRef:

params:

- name: name

value: determine-image-expiration

- name: bundle

value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510

- name: kind

value: task

resolver: bundles

- name: determine-image-tag

params:

- name: TAG_SUFFIX

value: $(params.output-tag-suffix)

- name: SOURCE_ARTIFACT

value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)

taskRef:

params:

- name: name

value: determine-image-tag

- name: bundle

value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510

- name: kind

value: task

resolver: bundles

- name: fetch-scanner-vuln-mappings

params:

- name: TARGET_DIR

value: .konflux/scanner-data

- name: SOURCE_ARTIFACT

value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)

- name: ociStorage

value: $(params.output-image-repo):konflux-$(params.revision).vuln-mappings

- name: ociArtifactExpiresAfter

value: $(params.oci-artifact-expires-after)

taskRef:

params:

- name: name

value: fetch-scanner-v4-vuln-mappings

- name: bundle

value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:18defc6b58a3792ef4d1c7268ce22167c833e7846523b97e0f3219094df0d510

- name: kind

value: task

resolver: bundles

- name: prefetch-dependencies

params:

- name: input

value: $(params.prefetch-input)

- name: SOURCE_ARTIFACT

value: $(tasks.fetch-scanner-vuln-mappings.results.SOURCE_ARTIFACT)

- name: ociStorage

value: $(params.output-image-repo):konflux-$(params.revision).prefetch

- name: ociArtifactExpiresAfter

value: $(params.oci-artifact-expires-after)

- name: ACTIVATION_KEY

value: subscription-manager-activation-key-prod

- name: enable-package-registry-proxy

value: $(params.enable-package-registry-proxy)

taskRef:

params:

- name: name

value: prefetch-dependencies-oci-ta

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.10.3@sha256:0c386f2c26b46b978280c5c54caac26bcd524975f8f7cc06bb080ba00eae3ad4

- name: kind

value: task

resolver: bundles

workspaces:

- name: git-basic-auth

workspace: git-auth

- name: build-images

matrix:

params:

- name: PLATFORM

value:

- $(params.build-platforms)

params:

- name: IMAGE

value: $(params.output-image-repo):$(tasks.determine-image-tag.results.IMAGE_TAG)

- name: DOCKERFILE

value: $(params.dockerfile)

- name: CONTEXT

value: $(params.path-context)

- name: HERMETIC

value: $(params.hermetic)

- name: PREFETCH_INPUT

value: $(params.prefetch-input)

- name: IMAGE_EXPIRES_AFTER

value: $(tasks.determine-image-expiration.results.IMAGE_EXPIRES_AFTER)

- name: COMMIT_SHA

value: $(tasks.clone-repository.results.commit)

- name: BUILD_ARGS

value:

- BUILD_TAG=$(tasks.determine-image-tag.results.IMAGE_TAG)

- name: SOURCE_ARTIFACT

value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)

- name: CACHI2_ARTIFACT

value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)

- name: BUILDAH_FORMAT

value: $(params.buildah-format)

- name: LABELS

value: ["$(params.extra-labels[*])"]

- name: BUILD_TIMESTAMP

value: "$(tasks.clone-repository.results.commit-timestamp)"

- name: IMAGE_APPEND_PLATFORM

value: "true"

- name: HTTP_PROXY

value: $(tasks.init.results.http-proxy)

- name: NO_PROXY

value: $(tasks.init.results.no-proxy)

- name: SOURCE_DATE_EPOCH

value: $(params.source-date-epoch)

- name: REWRITE_TIMESTAMP

value: $(params.rewrite-timestamp)

- name: OMIT_HISTORY

value: $(params.omit-history)

taskRef:

params:

- name: name

value: buildah-remote-oci-ta

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.2@sha256:a68dce8ed79be8d9e10d98bd2b56895c27fc34f1ed7d67cbc9ec0a91d64cf641

- name: kind

value: task

resolver: bundles

- name: build-image-index

params:

- name: IMAGE

value: $(params.output-image-repo):$(tasks.determine-image-tag.results.IMAGE_TAG)

- name: IMAGES

value:

- $(tasks.build-images.results.IMAGE_REF[*])

- name: BUILDAH_FORMAT

value: $(params.buildah-format)

taskRef:

params:

- name: name

value: build-image-index

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.4@sha256:654446d8ec028b20ed6ada8a96486ff16692a25192755aa04a99cea8e0afb7e2

- name: kind

value: task

resolver: bundles

runAfter: [build-images]

- name: build-source-image

params:

- name: BINARY_IMAGE

value: $(tasks.build-image-index.results.IMAGE_URL)

- name: SOURCE_ARTIFACT

value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)

- name: CACHI2_ARTIFACT

value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)

- name: BINARY_IMAGE_DIGEST

value: $(tasks.build-image-index.results.IMAGE_DIGEST)

taskRef:

params:

- name: name

value: source-build-oci-ta

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3.2@sha256:45091b5022754d452b4de60c7d7f4c6e03626efff55f96e9af937400fe3506eb

- name: kind

value: task

resolver: bundles

when:

- input: $(params.build-source-image)

operator: in

values: ["true"]

- name: deprecated-base-image-check

params:

- name: IMAGE_URL

value: $(tasks.build-image-index.results.IMAGE_URL)

- name: IMAGE_DIGEST

value: $(tasks.build-image-index.results.IMAGE_DIGEST)

taskRef:

params:

- name: name

value: deprecated-image-check

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872

- name: kind

value: task

resolver: bundles

when:

- input: $(params.skip-checks)

operator: in

values: ["false"]

- name: roxctl-scan

params:

- name: image-digest

value: $(tasks.build-image-index.results.IMAGE_DIGEST)

- name: image-url

value: $(tasks.build-image-index.results.IMAGE_URL)

taskRef:

params:

- name: name

value: roxctl-scan

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-roxctl-scan:0.1@sha256:97e2b2cdca9110fdc8a93ba585a1a1a743f989f2fd85f4073f6e5ea9ad2ce828

- name: kind

value: task

resolver: bundles

when:

- input: $(params.skip-checks)

operator: in

values: ["false"]

- name: clair-scan

params:

- name: image-digest

value: $(tasks.build-image-index.results.IMAGE_DIGEST)

- name: image-url

value: $(tasks.build-image-index.results.IMAGE_URL)

taskRef:

params:

- name: name

value: clair-scan

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.4.1@sha256:219964897ac4d5a9473ec297a1b39ae078a34b76b45d04c4672bd569cc295c29

- name: kind

value: task

resolver: bundles

when:

- input: $(params.skip-checks)

operator: in

values: ["false"]

- name: ecosystem-cert-preflight-checks

matrix:

params:

- name: platform

value:

- $(params.build-platforms)

params:

- name: image-url

value: $(tasks.build-image-index.results.IMAGE_URL)

taskRef:

params:

- name: name

value: ecosystem-cert-preflight-checks

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:fa53ef450ba538addafee1211ff6ac15b55865ce652fec15ac99b554680cb642

- name: kind

value: task

resolver: bundles

when:

- input: $(params.skip-checks)

operator: in

values: ["false"]

- name: sast-shell-check

params:

- name: image-digest

value: $(tasks.build-image-index.results.IMAGE_DIGEST)

- name: image-url

value: $(tasks.build-image-index.results.IMAGE_URL)

- name: SOURCE_ARTIFACT

value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)

- name: CACHI2_ARTIFACT

value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)

- name: TARGET_DIRS

value: $(params.sast-target-dirs)

taskRef:

params:

- name: name

value: sast-shell-check-oci-ta

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:d00c884c78489a52dc638e6ced0a01429670d0754f5b1305ad576709cf660312

- name: kind

value: task

resolver: bundles

when:

- input: $(params.skip-checks)

operator: in

values: ["false"]

- name: sast-unicode-check

params:

- name: image-digest

value: $(tasks.build-image-index.results.IMAGE_DIGEST)

- name: image-url

value: $(tasks.build-image-index.results.IMAGE_URL)

- name: SOURCE_ARTIFACT

value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)

- name: CACHI2_ARTIFACT

value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)

- name: TARGET_DIRS

value: $(params.sast-target-dirs)

taskRef:

params:

- name: name

value: sast-unicode-check-oci-ta

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:15d654c9576b9c4ee1f78b09fce541acf9afe33f1c2363fd6219a79dbf62c95d

- name: kind

value: task

resolver: bundles

when:

- input: $(params.skip-checks)

operator: in

values: ["false"]

- name: sast-snyk-check

params:

- name: SOURCE_ARTIFACT

value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)

- name: CACHI2_ARTIFACT

value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)

- name: image-digest

value: $(tasks.build-image-index.results.IMAGE_DIGEST)

- name: image-url

value: $(tasks.build-image-index.results.IMAGE_URL)

- name: TARGET_DIRS

value: $(params.sast-target-dirs)

taskRef:

params:

- name: name

value: sast-snyk-check-oci-ta

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:17b9587eba53fabaab35061275306bfe1f99661d55e14e22f62321fa7cb5ff3e

- name: kind

value: task

resolver: bundles

when:

- input: $(params.skip-checks)

operator: in

values: ["false"]

- name: clamav-scan

matrix:

params:

- name: image-arch

value:

- $(params.build-platforms)

params:

- name: image-digest

value: $(tasks.build-image-index.results.IMAGE_DIGEST)

- name: image-url

value: $(tasks.build-image-index.results.IMAGE_URL)

taskRef:

params:

- name: name

value: clamav-scan

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.3@sha256:9df272d2180bd67e6a3e04d5cd30ffa7ba27af4e599a1922f7069f5c89888e5b

- name: kind

value: task

resolver: bundles

when:

- input: $(params.skip-checks)

operator: in

values: ["false"]

- name: rpms-signature-scan

params:

- name: image-digest

value: $(tasks.build-image-index.results.IMAGE_DIGEST)

- name: image-url

value: $(tasks.build-image-index.results.IMAGE_URL)

taskRef:

params:

- name: name

value: rpms-signature-scan

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.2@sha256:d9df5d325f81a9fa132cb597c465aa9210b9b0fa3716b85b32be98d92c9c881a

- name: kind

value: task

resolver: bundles

when:

- input: $(params.skip-checks)

operator: in

values: ["false"]

- name: push-dockerfile

params:

- name: IMAGE

value: $(tasks.build-image-index.results.IMAGE_URL)

- name: IMAGE_DIGEST

value: $(tasks.build-image-index.results.IMAGE_DIGEST)

- name: DOCKERFILE

value: $(params.dockerfile)

- name: CONTEXT

value: $(params.path-context)

- name: SOURCE_ARTIFACT

value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)

taskRef:

params:

- name: name

value: push-dockerfile-oci-ta

- name: bundle

value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:4c567d11296850230fe32e76d129834d3bf337a0cae9989b64279b7cfaa4e735

- name: kind

value: task

resolver: bundles