Skip to content

ROX-27350: Use trusted tasks #1742

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Dec 20, 2024
Merged

ROX-27350: Use trusted tasks #1742

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
9dc8c60
Move `scripts/konflux/` to `.konflux/scripts`
msugakov Dec 12, 2024
dbc83eb
Switch to trusted tasks and delete in-repo ones
msugakov Dec 12, 2024
00eec1c
Switch fetching to go in a subdirectory instead of the repo root
msugakov Dec 12, 2024
941adf6
Adapt to renamed SCREAMING_CASE parameters
msugakov Dec 12, 2024
a80ab5c
Switch to latest tasks
msugakov Dec 17, 2024
02748af
Try fix custom task failures
msugakov Dec 18, 2024
af2a4dc
Switch to latest tasks
msugakov Dec 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .konflux/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
# .konflux

This directory is for files supporting ACS builds in Konflux.
There's no Konflux convention to use it. Rather, we organize our scripts and tools here ourselves.
3 changes: 3 additions & 0 deletions .konflux/scanner-data/.gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
# scanner-data is for blobs downloaded and included in Scanner V2 containers during build.
*
!.gitignore
0 ...pts/konflux/fail-build-if-git-is-dirty.sh → ...lux/scripts/fail-build-if-git-is-dirty.sh
View file
Open in desktop
File renamed without changes.
0 scripts/konflux/fetch-scanner-data.sh → .konflux/scripts/fetch-scanner-data.sh
View file
Open in desktop
File renamed without changes.
55 changes: 0 additions & 55 deletions .tekton/determine-image-tag-task.yaml
View file
Open in desktop

This file was deleted.

74 changes: 0 additions & 74 deletions .tekton/fetch-scanner-data-task.yaml
View file
Open in desktop

This file was deleted.

22 changes: 19 additions & 3 deletions .tekton/scanner-component-pipeline.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,20 +196,36 @@ spec:
- name: SOURCE_ARTIFACT
value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
taskRef:
name: determine-image-tag
params:
- name: name
value: determine-image-tag
- name: bundle
value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:886e1482c717078d11ba7c5d6fc4e8013e3740b4d1282ebe5534db62c9f19428
- name: kind
value: task
resolver: bundles

- name: fetch-scanner-data
params:
- name: blobs-to-fetch
- name: BLOBS_TO_FETCH
value: [ "$(params.blobs-to-fetch[*])" ]
- name: TARGET_DIR
value: .konflux/scanner-data
- name: SOURCE_ARTIFACT
value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
- name: ociStorage
value: $(params.output-image-repo):konflux-$(params.revision).prefetch
- name: ociArtifactExpiresAfter
value: $(params.oci-artifact-expires-after)
taskRef:
name: fetch-scanner-data
params:
- name: name
value: fetch-scanner-v2-data
- name: bundle
value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:886e1482c717078d11ba7c5d6fc4e8013e3740b4d1282ebe5534db62c9f19428
- name: kind
value: task
resolver: bundles

- name: prefetch-dependencies
params:
Expand Down
2 changes: 1 addition & 1 deletion image/db/rhel/konflux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,5 +69,5 @@ LABEL \
io.k8s.display-name="scanner-db" \
name="rhacs-scanner-db-rhel8"

COPY --chown=0:0 blob-pg-definitions.sql.gz \
COPY --chown=0:0 .konflux/scanner-data/blob-pg-definitions.sql.gz \
/docker-entrypoint-initdb.d/definitions.sql.gz
10 changes: 5 additions & 5 deletions image/scanner/rhel/konflux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,19 +16,19 @@ ENV CI=1
COPY . /src
WORKDIR /src

RUN scripts/konflux/fail-build-if-git-is-dirty.sh
RUN .konflux/scripts/fail-build-if-git-is-dirty.sh
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have this script in three different repositories. Can we run it as a separate task before build-container?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good idea to remove it from repos. Eventually this script only needed in determine-image-tag task.

I created https://issues.redhat.com/browse/ROX-27488


RUN unzip -j blob-repo2cpe.zip -d image/scanner/dump/repo2cpe && \
unzip -j blob-k8s-definitions.zip -d image/scanner/dump/k8s_definitions && \
unzip -j blob-nvd-definitions.zip -d image/scanner/dump/nvd_definitions
RUN unzip -j .konflux/scanner-data/blob-repo2cpe.zip -d image/scanner/dump/repo2cpe && \
unzip -j .konflux/scanner-data/blob-k8s-definitions.zip -d image/scanner/dump/k8s_definitions && \
unzip -j .konflux/scanner-data/blob-nvd-definitions.zip -d image/scanner/dump/nvd_definitions

RUN echo -n "version: " && make --quiet --no-print-directory tag && \
make CGO_ENABLED=1 scanner-build-nodeps

# Replace genesis manifests file in the source code with the one generated at
# the point when the dump was taken. This is to avoid discrepancy between other
# files of the dump and the manifest.
COPY ./blob-genesis_manifests.json image/scanner/dump/genesis_manifests.json
COPY .konflux/scanner-data/blob-genesis_manifests.json image/scanner/dump/genesis_manifests.json


# Common base for scanner slim and full
Expand Down
Loading