Release pipeline (trustification#1043)

Signed-off-by: desmax74 <[email protected]>
desmax74 · Jan 23, 2024 · 7ce9b72 · 7ce9b72
1 parent da9b4c0
commit 7ce9b72
Showing 1 changed file with 398 additions and 0 deletions.
diff --git a/.tekton/trustification-service-release.yaml b/.tekton/trustification-service-release.yaml
@@ -0,0 +1,398 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+ annotations:
+ build.appstudio.openshift.io/repo: https://github.com/trustification/trustification?rev={{revision}}
+ build.appstudio.redhat.com/commit_sha: '{{revision}}'
+ build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+ pipelinesascode.tekton.dev/on-target-branch: "[refs/tags/*]"
+ pipelinesascode.tekton.dev/on-event: "[push]"
+ pipelinesascode.tekton.dev/max-keep-runs: "3"
+ pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "stable"
+ creationTimestamp: null
+ labels:
+ appstudio.openshift.io/application: trustification
+ appstudio.openshift.io/component: trustification-service
+ pipelines.appstudio.openshift.io/type: build
+ name: trustification-service-release
+ namespace: trusted-content-tenant
+spec:
+ params:
+ - name: dockerfile
+ value: https://raw.githubusercontent.com/trustification/trustification/stable/container_files/Containerfile.services
+ - name: git-url
+ value: '{{repo_url}}'
+ - name: output-image
+ value: quay.io/trustification/trustification-service-release:{{revision}}
+ - name: path-context
+ value: .
+ - name: revision
+ value: '{{revision}}'
+ pipelineSpec:
+ finally:
+ - name: show-sbom
+ params:
+ - name: IMAGE_URL
+ value: $(tasks.build-container.results.IMAGE_URL)
+ taskRef:
+ params:
+ - name: name
+ value: show-sbom
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-show-sbom:0.1@sha256:202d3c3385120ea847d8f0a82bd8d9d5e873d67f981d6f8a51fb1706caaf6bef
+ - name: kind
+ value: task
+ resolver: bundles
+ - name: show-summary
+ params:
+ - name: pipelinerun-name
+ value: $(context.pipelineRun.name)
+ - name: git-url
+ value: $(tasks.clone-repository.results.url)?rev=$(tasks.clone-repository.results.commit)
+ - name: image-url
+ value: $(params.output-image)
+ - name: build-task-status
+ value: $(tasks.build-container.status)
+ taskRef:
+ params:
+ - name: name
+ value: summary
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-summary:0.1@sha256:f65a69aaf71cbab382eff685eee522ad35068a4d91d233e76cef7d42ff15a686
+ - name: kind
+ value: task
+ resolver: bundles
+ params:
+ - description: Source Repository URL
+ name: git-url
+ type: string
+ - default: ""
+ description: Revision of the Source Repository
+ name: revision
+ type: string
+ - description: Fully Qualified Output Image
+ name: output-image
+ type: string
+ - default: .
+ description: Path to the source code of an application's component from where
+ to build image.
+ name: path-context
+ type: string
+ - default: Dockerfile
+ description: Path to the Dockerfile inside the context specified by parameter
+ path-context
+ name: dockerfile
+ type: string
+ - default: "false"
+ description: Force rebuild image
+ name: rebuild
+ type: string
+ - default: "false"
+ description: Skip checks against built image
+ name: skip-checks
+ type: string
+ - default: "true"
+ description: Skip optional checks, set false if you want to run optional checks
+ name: skip-optional
+ type: string
+ - default: "false"
+ description: Execute the build with network isolation
+ name: hermetic
+ type: string
+ - default: ""
+ description: Build dependencies to be prefetched by Cachi2
+ name: prefetch-input
+ type: string
+ - default: "false"
+ description: Java build
+ name: java
+ type: string
+ - default: ""
+ description: Image tag expiration time, time values could be something like
+ 1h, 2d, 3w for hours, days, and weeks, respectively.
+ name: image-expires-after
+ - default: "false"
+ description: Build a source image.
+ name: build-source-image
+ type: string
+ results:
+ - description: ""
+ name: IMAGE_URL
+ value: $(tasks.build-container.results.IMAGE_URL)
+ - description: ""
+ name: IMAGE_DIGEST
+ value: $(tasks.build-container.results.IMAGE_DIGEST)
+ - description: ""
+ name: CHAINS-GIT_URL
+ value: $(tasks.clone-repository.results.url)
+ - description: ""
+ name: CHAINS-GIT_COMMIT
+ value: $(tasks.clone-repository.results.commit)
+ - description: ""
+ name: JAVA_COMMUNITY_DEPENDENCIES
+ value: $(tasks.build-container.results.JAVA_COMMUNITY_DEPENDENCIES)
+ tasks:
+ - name: init
+ params:
+ - name: image-url
+ value: $(params.output-image)
+ - name: rebuild
+ value: $(params.rebuild)
+ - name: skip-checks
+ value: $(params.skip-checks)
+ - name: skip-optional
+ value: $(params.skip-optional)
+ - name: pipelinerun-name
+ value: $(context.pipelineRun.name)
+ - name: pipelinerun-uid
+ value: $(context.pipelineRun.uid)
+ taskRef:
+ params:
+ - name: name
+ value: init
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-init:0.1@sha256:c35cc37d6f40fef0f2ed614b502b058e13fe7af29c0888bc4799fd625b6f3374
+ - name: kind
+ value: task
+ resolver: bundles
+ - name: clone-repository
+ params:
+ - name: url
+ value: $(params.git-url)
+ - name: revision
+ value: $(params.revision)
+ runAfter:
+ - init
+ taskRef:
+ params:
+ - name: name
+ value: git-clone
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-git-clone:0.1@sha256:b8fddc2d36313a5cde93aba2491205f4a84e6853af6c34ede681f8339b147478
+ - name: kind
+ value: task
+ resolver: bundles
+ when:
+ - input: $(tasks.init.results.build)
+ operator: in
+ values:
+ - "true"
+ workspaces:
+ - name: output
+ workspace: workspace
+ - name: basic-auth
+ workspace: git-auth
+ - name: prefetch-dependencies
+ params:
+ - name: input
+ value: $(params.prefetch-input)
+ runAfter:
+ - clone-repository
+ taskRef:
+ params:
+ - name: name
+ value: prefetch-dependencies
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-prefetch-dependencies:0.1@sha256:9630dd7d50002fdffb4a406fb0c538703ef98bf2f4318249ac3a2c229938dbea
+ - name: kind
+ value: task
+ resolver: bundles
+ when:
+ - input: $(params.hermetic)
+ operator: in
+ values:
+ - "true"
+ workspaces:
+ - name: source
+ workspace: workspace
+ - name: build-container
+ params:
+ - name: IMAGE
+ value: $(params.output-image)
+ - name: DOCKERFILE
+ value: $(params.dockerfile)
+ - name: CONTEXT
+ value: $(params.path-context)
+ - name: HERMETIC
+ value: $(params.hermetic)
+ - name: PREFETCH_INPUT
+ value: $(params.prefetch-input)
+ - name: IMAGE_EXPIRES_AFTER
+ value: $(params.image-expires-after)
+ - name: COMMIT_SHA
+ value: $(tasks.clone-repository.results.commit)
+ runAfter:
+ - prefetch-dependencies
+ taskRef:
+ params:
+ - name: name
+ value: buildah
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-buildah:0.1@sha256:155ba11fda63c10ac3a824f4c2db385c22299551124db5d239b325b576249839
+ - name: kind
+ value: task
+ resolver: bundles
+ when:
+ - input: $(tasks.init.results.build)
+ operator: in
+ values:
+ - "true"
+ workspaces:
+ - name: source
+ workspace: workspace
+ - name: build-source-image
+ params:
+ - name: BINARY_IMAGE
+ value: $(params.output-image)
+ - name: BASE_IMAGES
+ value: $(tasks.build-container.results.BASE_IMAGES_DIGESTS)
+ runAfter:
+ - build-container
+ taskRef:
+ params:
+ - name: name
+ value: source-build
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-source-build:0.1@sha256:f8c5dec871fb5347eb2fc61d44754bcc101897aecf953b374ab3e8315e1a9804
+ - name: kind
+ value: task
+ resolver: bundles
+ when:
+ - input: $(tasks.init.results.build)
+ operator: in
+ values:
+ - "true"
+ - input: $(params.build-source-image)
+ operator: in
+ values:
+ - "true"
+ workspaces:
+ - name: workspace
+ workspace: workspace
+ - name: deprecated-base-image-check
+ params:
+ - name: BASE_IMAGES_DIGESTS
+ value: $(tasks.build-container.results.BASE_IMAGES_DIGESTS)
+ runAfter:
+ - build-container
+ taskRef:
+ params:
+ - name: name
+ value: deprecated-image-check
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-deprecated-image-check:0.3@sha256:d87f8c50a674f57527a0c4f3df6d9093941a2ae84739b55368b3c11702ce340c
+ - name: kind
+ value: task
+ resolver: bundles
+ when:
+ - input: $(params.skip-checks)
+ operator: in
+ values:
+ - "false"
+ - name: clair-scan
+ params:
+ - name: image-digest
+ value: $(tasks.build-container.results.IMAGE_DIGEST)
+ - name: image-url
+ value: $(tasks.build-container.results.IMAGE_URL)
+ runAfter:
+ - build-container
+ taskRef:
+ params:
+ - name: name
+ value: clair-scan
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-clair-scan:0.1@sha256:fbe1ab58531d856fba360060d3884a0606310a966e2d01ba9305da9eb01ab916
+ - name: kind
+ value: task
+ resolver: bundles
+ when:
+ - input: $(params.skip-checks)
+ operator: in
+ values:
+ - "false"
+ - name: sast-snyk-check
+ runAfter:
+ - clone-repository
+ taskRef:
+ params:
+ - name: name
+ value: sast-snyk-check
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-sast-snyk-check:0.1@sha256:eee508768b14655275fbcc2f42f9da1ab553b872dcbe113b0896aa9bcf7e1adf
+ - name: kind
+ value: task
+ resolver: bundles
+ when:
+ - input: $(params.skip-checks)
+ operator: in
+ values:
+ - "false"
+ workspaces:
+ - name: workspace
+ workspace: workspace
+ - name: clamav-scan
+ params:
+ - name: image-digest
+ value: $(tasks.build-container.results.IMAGE_DIGEST)
+ - name: image-url
+ value: $(tasks.build-container.results.IMAGE_URL)
+ runAfter:
+ - build-container
+ taskRef:
+ params:
+ - name: name
+ value: clamav-scan
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-clamav-scan:0.1@sha256:d72cb58db88289559676676c3db43906718028e07279f70ddb12ed8bdc8e2860
+ - name: kind
+ value: task
+ resolver: bundles
+ when:
+ - input: $(params.skip-checks)
+ operator: in
+ values:
+ - "false"
+ - name: sbom-json-check
+ params:
+ - name: IMAGE_URL
+ value: $(tasks.build-container.results.IMAGE_URL)
+ - name: IMAGE_DIGEST
+ value: $(tasks.build-container.results.IMAGE_DIGEST)
+ runAfter:
+ - build-container
+ taskRef:
+ params:
+ - name: name
+ value: sbom-json-check
+ - name: bundle
+ value: quay.io/redhat-appstudio-tekton-catalog/task-sbom-json-check:0.1@sha256:717e6e33f02dbe1a28fb743f32699e002c944680c251a50b644f27becb9208e9
+ - name: kind
+ value: task
+ resolver: bundles
+ when:
+ - input: $(params.skip-checks)
+ operator: in
+ values:
+ - "false"
+ workspaces:
+ - name: workspace
+ - name: docker-credentials
+ optional: true
+ taskRunTemplate: {}
+ workspaces:
+ - name: workspace
+ volumeClaimTemplate:
+ metadata:
+ creationTimestamp: null
+ spec:
+ accessModes:
+ - ReadWriteOnce
+ resources:
+ requests:
+ storage: 1Gi
+ status: {}
+ - name: docker-credentials
+ secret:
+ secretName: trustification-service-release
+status: {}