Created
August 28, 2024 14:45
-
-
Save cmoulliard/337205a909998654a20e2880b35cb023 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: tekton.dev/v1 | |
| kind: PipelineRun | |
| metadata: | |
| annotations: | |
| build.appstudio.openshift.io/repo: https://github.com/ch007m/konflux-demo?rev={{revision}} | |
| build.appstudio.redhat.com/commit_sha: '{{revision}}' | |
| build.appstudio.redhat.com/target_branch: '{{target_branch}}' | |
| pipelinesascode.tekton.dev/max-keep-runs: "3" | |
| pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch | |
| == "main" | |
| labels: | |
| appstudio.openshift.io/application: konflux-demo | |
| appstudio.openshift.io/component: konflux-demo | |
| pipelines.appstudio.openshift.io/type: build | |
| name: konflux-demo-on-push | |
| namespace: cmoullia-tenant | |
| spec: | |
| params: | |
| - name: git-url | |
| value: '{{source_url}}' | |
| - name: revision | |
| value: '{{revision}}' | |
| - name: output-image | |
| value: quay.io/redhat-user-workloads/cmoullia-tenant/konflux-demo/konflux-demo:{{revision}} | |
| - name: dockerfile | |
| value: Dockerfile | |
| pipelineSpec: | |
| finally: | |
| - name: show-sbom | |
| params: | |
| - name: IMAGE_URL | |
| value: $(tasks.build-image-index.results.IMAGE_URL) | |
| taskRef: | |
| params: | |
| - name: name | |
| value: show-sbom | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:9bfc6b99ef038800fe131d7b45ff3cd4da3a415dd536f7c657b3527b01c4a13b | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| params: | |
| - description: Source Repository URL | |
| name: git-url | |
| type: string | |
| - default: "" | |
| description: Revision of the Source Repository | |
| name: revision | |
| type: string | |
| - description: Fully Qualified Output Image | |
| name: output-image | |
| type: string | |
| - default: . | |
| description: Path to the source code of an application's component from where | |
| to build image. | |
| name: path-context | |
| type: string | |
| - default: Dockerfile | |
| description: Path to the Dockerfile inside the context specified by parameter | |
| path-context | |
| name: dockerfile | |
| type: string | |
| - default: "false" | |
| description: Force rebuild image | |
| name: rebuild | |
| type: string | |
| - default: "false" | |
| description: Skip checks against built image | |
| name: skip-checks | |
| type: string | |
| - default: "false" | |
| description: Execute the build with network isolation | |
| name: hermetic | |
| type: string | |
| - default: "" | |
| description: Build dependencies to be prefetched by Cachi2 | |
| name: prefetch-input | |
| type: string | |
| - default: "" | |
| description: Image tag expiration time, time values could be something like 1h, | |
| 2d, 3w for hours, days, and weeks, respectively. | |
| name: image-expires-after | |
| - default: "false" | |
| description: Build a source image. | |
| name: build-source-image | |
| type: string | |
| - default: "false" | |
| description: Add built image into an OCI image index | |
| name: build-image-index | |
| type: string | |
| - default: [] | |
| description: Array of --build-arg values ("arg=value" strings) for buildah | |
| name: build-args | |
| type: array | |
| - default: "" | |
| description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file | |
| name: build-args-file | |
| type: string | |
| results: | |
| - description: "" | |
| name: IMAGE_URL | |
| value: $(tasks.build-image-index.results.IMAGE_URL) | |
| - description: "" | |
| name: IMAGE_DIGEST | |
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | |
| - description: "" | |
| name: CHAINS-GIT_URL | |
| value: $(tasks.clone-repository.results.url) | |
| - description: "" | |
| name: CHAINS-GIT_COMMIT | |
| value: $(tasks.clone-repository.results.commit) | |
| tasks: | |
| - name: init | |
| params: | |
| - name: image-url | |
| value: $(params.output-image) | |
| - name: rebuild | |
| value: $(params.rebuild) | |
| - name: skip-checks | |
| value: $(params.skip-checks) | |
| taskRef: | |
| params: | |
| - name: name | |
| value: init | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:092c113b614f6551113f17605ae9cb7e822aa704d07f0e37ed209da23ce392cc | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| - name: clone-repository | |
| params: | |
| - name: url | |
| value: $(params.git-url) | |
| - name: revision | |
| value: $(params.revision) | |
| - name: ociStorage | |
| value: $(params.output-image).git | |
| - name: ociArtifactExpiresAfter | |
| value: $(params.image-expires-after) | |
| runAfter: | |
| - init | |
| taskRef: | |
| params: | |
| - name: name | |
| value: git-clone-oci-ta | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:0f4360ce144d46171ebd2e8f4d4575539a0600e02208ba5fc9beeb2c27ddfd4c | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| when: | |
| - input: $(tasks.init.results.build) | |
| operator: in | |
| values: | |
| - "true" | |
| workspaces: | |
| - name: basic-auth | |
| workspace: git-auth | |
| - name: prefetch-dependencies | |
| params: | |
| - name: input | |
| value: $(params.prefetch-input) | |
| - name: SOURCE_ARTIFACT | |
| value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) | |
| - name: ociStorage | |
| value: $(params.output-image).prefetch | |
| - name: ociArtifactExpiresAfter | |
| value: $(params.image-expires-after) | |
| runAfter: | |
| - clone-repository | |
| taskRef: | |
| params: | |
| - name: name | |
| value: prefetch-dependencies-oci-ta | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.1@sha256:135f0419206a21cf70fba5f608e7fcfad62a05c1d3def9bb820f76946847ad15 | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| workspaces: | |
| - name: git-basic-auth | |
| workspace: git-auth | |
| - name: netrc | |
| workspace: netrc | |
| - name: build-container | |
| params: | |
| - name: IMAGE | |
| value: $(params.output-image) | |
| - name: DOCKERFILE | |
| value: $(params.dockerfile) | |
| - name: CONTEXT | |
| value: $(params.path-context) | |
| - name: HERMETIC | |
| value: $(params.hermetic) | |
| - name: PREFETCH_INPUT | |
| value: $(params.prefetch-input) | |
| - name: IMAGE_EXPIRES_AFTER | |
| value: $(params.image-expires-after) | |
| - name: COMMIT_SHA | |
| value: $(tasks.clone-repository.results.commit) | |
| - name: BUILD_ARGS | |
| value: | |
| - $(params.build-args[*]) | |
| - name: BUILD_ARGS_FILE | |
| value: $(params.build-args-file) | |
| - name: SOURCE_ARTIFACT | |
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | |
| - name: CACHI2_ARTIFACT | |
| value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) | |
| runAfter: | |
| - prefetch-dependencies | |
| taskRef: | |
| params: | |
| - name: name | |
| value: buildah-oci-ta | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.2@sha256:24ac35ca673cc679d0fe4ecbde2bb349b8d40c341638ed87a6272fe78ac31958 | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| when: | |
| - input: $(tasks.init.results.build) | |
| operator: in | |
| values: | |
| - "true" | |
| - name: build-image-index | |
| params: | |
| - name: IMAGE | |
| value: $(params.output-image) | |
| - name: COMMIT_SHA | |
| value: $(tasks.clone-repository.results.commit) | |
| - name: IMAGE_EXPIRES_AFTER | |
| value: $(params.image-expires-after) | |
| - name: ALWAYS_BUILD_INDEX | |
| value: $(params.build-image-index) | |
| - name: IMAGES | |
| value: | |
| - $(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST) | |
| runAfter: | |
| - build-container | |
| taskRef: | |
| params: | |
| - name: name | |
| value: build-image-index | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:409ff39379c50d3c257229b4c6d6600e35eb53637504c47fb36ade262c70716e | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| when: | |
| - input: $(tasks.init.results.build) | |
| operator: in | |
| values: | |
| - "true" | |
| - name: build-source-image | |
| params: | |
| - name: BINARY_IMAGE | |
| value: $(params.output-image) | |
| - name: SOURCE_ARTIFACT | |
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | |
| - name: CACHI2_ARTIFACT | |
| value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) | |
| runAfter: | |
| - build-image-index | |
| taskRef: | |
| params: | |
| - name: name | |
| value: source-build-oci-ta | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.1@sha256:78ff0710e0634639de7add782c6c31c3706b05ffa4b4b853c1eca3b8af0d6131 | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| when: | |
| - input: $(tasks.init.results.build) | |
| operator: in | |
| values: | |
| - "true" | |
| - input: $(params.build-source-image) | |
| operator: in | |
| values: | |
| - "true" | |
| - name: deprecated-base-image-check | |
| params: | |
| - name: IMAGE_URL | |
| value: $(tasks.build-image-index.results.IMAGE_URL) | |
| - name: IMAGE_DIGEST | |
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | |
| runAfter: | |
| - build-image-index | |
| taskRef: | |
| params: | |
| - name: name | |
| value: deprecated-image-check | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.4@sha256:d98fa9daf5ee12dfbf00880b83d092d01ce9994d79836548d2f82748bb0c64a2 | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| when: | |
| - input: $(params.skip-checks) | |
| operator: in | |
| values: | |
| - "false" | |
| - name: clair-scan | |
| params: | |
| - name: image-digest | |
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | |
| - name: image-url | |
| value: $(tasks.build-image-index.results.IMAGE_URL) | |
| runAfter: | |
| - build-image-index | |
| taskRef: | |
| params: | |
| - name: name | |
| value: clair-scan | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.1@sha256:baea4be429cf8d91f7c758378cea42819fe324f25a7f957bf9805409cab6d123 | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| when: | |
| - input: $(params.skip-checks) | |
| operator: in | |
| values: | |
| - "false" | |
| - name: ecosystem-cert-preflight-checks | |
| params: | |
| - name: image-url | |
| value: $(tasks.build-image-index.results.IMAGE_URL) | |
| - name: CACHI2_ARTIFACT | |
| value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) | |
| runAfter: | |
| - build-image-index | |
| taskRef: | |
| params: | |
| - name: name | |
| value: ecosystem-cert-preflight-checks | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.1@sha256:5131cce0f93d0b728c7bcc0d6cee4c61d4c9f67c6d619c627e41e3c9775b497d | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| when: | |
| - input: $(params.skip-checks) | |
| operator: in | |
| values: | |
| - "false" | |
| - name: sast-snyk-check | |
| params: | |
| - name: image-digest | |
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | |
| - name: image-url | |
| value: $(tasks.build-image-index.results.IMAGE_URL) | |
| - name: SOURCE_ARTIFACT | |
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | |
| runAfter: | |
| - build-image-index | |
| taskRef: | |
| params: | |
| - name: name | |
| value: sast-snyk-check-oci-ta | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.2@sha256:55bcb22a020208cce4388c8eaf9f3cdf6a51e5e464123bbb4f9eeac41a99c015 | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| when: | |
| - input: $(params.skip-checks) | |
| operator: in | |
| values: | |
| - "false" | |
| - name: clamav-scan | |
| params: | |
| - name: image-digest | |
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | |
| - name: image-url | |
| value: $(tasks.build-image-index.results.IMAGE_URL) | |
| runAfter: | |
| - build-image-index | |
| taskRef: | |
| params: | |
| - name: name | |
| value: clamav-scan | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.1@sha256:7bb17b937c9342f305468e8a6d0a22493e3ecde58977bd2ffc8b50e2fa234d58 | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| when: | |
| - input: $(params.skip-checks) | |
| operator: in | |
| values: | |
| - "false" | |
| - name: sbom-json-check | |
| params: | |
| - name: IMAGE_URL | |
| value: $(tasks.build-image-index.results.IMAGE_URL) | |
| - name: IMAGE_DIGEST | |
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | |
| runAfter: | |
| - build-image-index | |
| taskRef: | |
| params: | |
| - name: name | |
| value: sbom-json-check | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-sbom-json-check:0.1@sha256:2c5de51ec858fc8d47e41c65b20c83fdac249425d67ed6d1058f9f3e0b574500 | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| when: | |
| - input: $(params.skip-checks) | |
| operator: in | |
| values: | |
| - "false" | |
| - name: apply-tags | |
| params: | |
| - name: IMAGE | |
| value: $(tasks.build-image-index.results.IMAGE_URL) | |
| runAfter: | |
| - build-image-index | |
| taskRef: | |
| params: | |
| - name: name | |
| value: apply-tags | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.1@sha256:e6beb161ed59d7be26317da03e172137b31b26648d3e139558e9a457bc56caff | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| - name: push-dockerfile | |
| params: | |
| - name: IMAGE | |
| value: $(tasks.build-image-index.results.IMAGE_URL) | |
| - name: IMAGE_DIGEST | |
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | |
| - name: DOCKERFILE | |
| value: $(params.dockerfile) | |
| - name: CONTEXT | |
| value: $(params.path-context) | |
| - name: SOURCE_ARTIFACT | |
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | |
| runAfter: | |
| - build-image-index | |
| taskRef: | |
| params: | |
| - name: name | |
| value: push-dockerfile-oci-ta | |
| - name: bundle | |
| value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:009f62dd77a6e57e675c4843dd7e39f6e35375182633166cff01241fd7998615 | |
| - name: kind | |
| value: task | |
| resolver: bundles | |
| workspaces: | |
| - name: git-auth | |
| secret: | |
| secretName: '{{ git_auth_secret }}' | |
| status: {} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment