openshift-pipelines
diff --git a/‎head‎
Lines changed: 1 addition & 1 deletion b/‎head‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎upstream/.github/workflows/ci.yaml‎
Lines changed: 157 additions & 0 deletions b/‎upstream/.github/workflows/ci.yaml‎
Lines changed: 157 additions & 0 deletions
diff --git a/‎upstream/.github/workflows/kind-e2e.yaml‎
Lines changed: 12 additions & 9 deletions b/‎upstream/.github/workflows/kind-e2e.yaml‎
Lines changed: 12 additions & 9 deletions
diff --git a/‎upstream/.github/workflows/lint.yaml‎
Lines changed: 0 additions & 55 deletions b/‎upstream/.github/workflows/lint.yaml‎
Lines changed: 0 additions & 55 deletions
diff --git a/‎upstream/.github/workflows/reusable-e2e.yaml‎
Lines changed: 23 additions & 20 deletions b/‎upstream/.github/workflows/reusable-e2e.yaml‎
Lines changed: 23 additions & 20 deletions
diff --git a/‎upstream/.github/workflows/test-on-microshift.yaml‎
Lines changed: 2 additions & 2 deletions b/‎upstream/.github/workflows/test-on-microshift.yaml‎
Lines changed: 2 additions & 2 deletions
@@ -1 +1 @@
-bee7519eb20a587f8e063ff2016725970c1d1b7c
+a51457de691e0edb45a4588a8e0c85cfa9df16eb
@@ -0,0 +1,157 @@
+name: ci
+
+'on':
+  pull_request: {}
+  merge_group: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.merge_group.head_ref || github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    name: categorize changes
+    runs-on: ubuntu-latest
+    outputs:
+      non-docs: ${{ steps.detect.outputs.non-docs }}
+      yaml: ${{ steps.detect.outputs.yaml }}
+    steps:
+    - name: Get base depth
+      id: base-depth
+      run: echo "base-depth=$(expr ${{ github.event.pull_request.commits }} + 1)" >> $GITHUB_OUTPUT
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        fetch-depth: ${{ steps.base-depth.outputs.base-depth }}
+        persist-credentials: false
+    - name: detect
+      id: detect
+      run: |
+        git fetch origin ${GITHUB_BASE_REF}
+        CHANGED_FILES=$(git diff --name-only ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} | tr ' ' '\n')
+
+        echo -e "Changed files:\n${CHANGED_FILES}"
+
+        # If no files are changed at all, then `grep -v` will match even though no change outputs
+        # should be true. Skipping output on an empty set of changes eliminates the false positive
+        if [[ -n "${CHANGED_FILES}" ]]; then
+          NON_DOCS=$(echo "${CHANGED_FILES}" | grep -Eqv '\.md$' && echo 'true' || echo 'false')
+          YAML=$(echo "${CHANGED_FILES}" | grep -Eq '\.ya?ml$' && echo 'true' || echo 'false')
+          echo "non-docs=${NON_DOCS}" | tee -a $GITHUB_OUTPUT
+          echo "yaml=${YAML}" | tee -a $GITHUB_OUTPUT
+        fi
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    needs: [changes]
+    if: ${{ needs.changes.outputs.non-docs == 'true' }}
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      with:
+        persist-credentials: false
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+      with:
+        go-version-file: "go.mod"
+    - name: build
+      run: |
+        go build -v ./...
+  linting:
+    name: lint
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write  # Used by golangci-lint to annotate code in the PR
+    needs: [changes]
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      with:
+        fetch-depth: 0
+        persist-credentials: false
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+      with:
+        go-version-file: "go.mod"
+    - name: gofmt
+      if: ${{ needs.changes.outputs.non-docs == 'true' }}
+      run: |
+        gofmt_out=$(gofmt -d $(find * -name '*.go' ! -path 'vendor/*' ! -path 'third_party/*'))
+        if [[ -n "$gofmt_out" ]]; then
+            failed=1
+        fi
+        echo "$gofmt_out"
+    - name: golangci-lint
+      uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20  # v9.2.0
+      if: ${{ needs.changes.outputs.non-docs == 'true' }}
+      with:
+        version: v2.7.2
+        args: --new-from-merge-base=origin/${{ github.base_ref }} --timeout=10m
+    - name: yamllint
+      if: ${{ needs.changes.outputs.yaml == 'true' }}
+      run: |
+        apt-get update && apt-get install -y yamllint
+        make yamllint
+    - name: check-license
+      if: ${{ needs.changes.outputs.non-docs == 'true' }}
+      run: |
+        go install github.com/google/go-licenses@v1.0.0
+        go-licenses check ./...
+  tests:
+    needs: [build]
+    name: test
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      with:
+        persist-credentials: false
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+      with:
+        go-version-file: "go.mod"
+    - name: unit-test
+      run: |
+        make test-unit-verbose-and-race
+  e2e-tests:
+    needs: [build]
+    uses: ./.github/workflows/kind-e2e.yaml
+
+  ci-summary:
+    name: CI summary
+    needs: [build, linting, tests, e2e-tests]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+    - name: Check CI results
+      run: |
+        results=(
+          "build=${NEEDS_BUILD_RESULT}"
+          "linting=${NEEDS_LINTING_RESULT}"
+          "tests=${NEEDS_TESTS_RESULT}"
+          "e2e-tests=${NEEDS_E2E_TESTS_RESULT}"
+        )
+        failed=0
+        for r in "${results[@]}"; do
+          name="${r%%=*}"
+          result="${r#*=}"
+          echo "${name}: ${result}"
+          if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then
+            failed=1
+          fi
+        done
+        if [ "$failed" -eq 1 ]; then
+          echo ""
+          echo "Some CI jobs failed or were cancelled"
+          exit 1
+        fi
+        echo ""
+        echo "All CI checks passed"
+      env:
+        NEEDS_BUILD_RESULT: ${{ needs.build.result }}
+        NEEDS_LINTING_RESULT: ${{ needs.linting.result }}
+        NEEDS_TESTS_RESULT: ${{ needs.tests.result }}
+        NEEDS_E2E_TESTS_RESULT: ${{ needs.e2e-tests.result }}
@@ -1,14 +1,12 @@
 name: Chains kind E2E Tests
 
-on:
-  pull_request:
-    branches:
-      - main
-      - release-*
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
+'on':
+  workflow_call: {}
+# on:
+#   pull_request:
+#     branches:
+#       - main
+#       - release-*
 
 defaults:
   run:
@@ -17,6 +15,11 @@ defaults:
 
 jobs:
   k8s:
+    permissions:
+      contents: read
+    concurrency:
+      group: ${{ github.workflow }}-${{ matrix.k8s-version }}-${{ github.event.pull_request.number || github.ref }}
+      cancel-in-progress: true
     strategy:
       fail-fast: false # Keep running if one leg fails.
       matrix:
 
@@ -1,7 +1,6 @@
-
 name: Reusable workflow example
 
-on:
+'on':
   workflow_call:
     inputs:
       pipelines-release:
@@ -23,41 +22,40 @@ jobs:
 
     env:
       GOPATH: ${{ github.workspace }}
-      GO111MODULE: on
+      GO111MODULE: 'on'
       GOFLAGS: -ldflags=-s -ldflags=-w
       KO_DOCKER_REPO: registry.local:5000/knative
       KOCACHE: ~/ko
       SIGSTORE_SCAFFOLDING_RELEASE_VERSION: "v0.7.24"
-      TEKTON_PIPELINES_RELEASE: "https://storage.googleapis.com/tekton-releases/pipeline/previous/${{ inputs.pipelines-release }}/release.yaml"
+      TEKTON_PIPELINES_RELEASE: "https://infra.tekton.dev/tekton-releases/pipeline/previous/${{ inputs.pipelines-release }}/release.yaml"
       # Note that we do not include the v prefix here so we can use it in all
       # the places this is used.
       SKIP_INITIALIZE: true
 
     steps:
-    - name: Set up Go
-      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
-      with:
-        go-version: 1.22.x
 
-    - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
+    - name: Check out our repo
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
-        version: tip
+        persist-credentials: false
 
-    - name: Check out our repo
-      uses: actions/checkout@6d193bf28034eafb982f37bd894289fe649468fc # v4.1.7
+    - name: Set up Go
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
       with:
-        path: ./src/github.com/tektoncd/chains
+        go-version-file: "go.mod"
+
+    - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
 
     - name: Install mirror, kind, knative + sigstore
-      uses: sigstore/scaffolding/actions/setup@d40cf576f588d980142f0b8462c425d7b32f00b1 # v0.7.25
+      uses: sigstore/scaffolding/actions/setup@8bd68672d418e5bd1b0ee1f2e2981874c3a30967  # v0.7.33
       with:
         k8s-version: ${{ inputs.k8s-version }}
         version: ${{ env.SIGSTORE_SCAFFOLDING_RELEASE_VERSION }}
         knative-version: 1.9.0
 
     - name: Install Tekton pipelines
       run: |
-        while ! kubectl apply --filename ${{ env.TEKTON_PIPELINES_RELEASE }}
+        while ! kubectl apply --filename ${TEKTON_PIPELINES_RELEASE}
         do
           echo "waiting for tekton pipelines to get installed"
           sleep 2
@@ -67,7 +65,6 @@ jobs:
         kubectl -n tekton-pipelines delete po -l app=tekton-pipelines-controller
 
     - name: Run integration tests
-      working-directory: ./src/github.com/tektoncd/chains
       run: |
         ./test/presubmit-tests.sh --integration-tests
 
@@ -82,9 +79,12 @@ jobs:
         # Restart chains controller so picks up the changes.
         kubectl -n tekton-chains delete po -l app=tekton-chains-controller
 
-        # TODO(vaikas): Better way to find when the chains has picked up
-        # the changes
-        sleep 20
+        # Wait for chains controller to be ready again
+        echo "Waiting for chains controller to be ready"
+        kubectl wait --for=condition=ready --timeout=2m -n tekton-chains pod -l app=tekton-chains-controller
+
+        # Give chains a moment to reload the configuration
+        sleep 5
 
         kubectl create -f https://raw.githubusercontent.com/tektoncd/chains/main/examples/taskruns/task-output-image.yaml
 
@@ -116,11 +116,14 @@ jobs:
         done
 
         # Did not find entry, fail
+        echo "Failed to find rekor transparency entry after 10 attempts"
+        kubectl get taskruns -oyaml
+        kubectl logs -n tekton-chains -l app=tekton-chains-controller --tail=100
         exit 1
 
     - name: Collect diagnostics
       if: ${{ failure() }}
-      uses: chainguard-dev/actions/kind-diag@5363dd9eb48083bbf7674a4bbe62d71c3b230edd # v1.1.2
+      uses: chainguard-dev/actions/kind-diag@de68b87302e6266db5fb5220246f8aa46fe94b67  # v1.6.14
       with:
         cluster-resources: nodes
         namespace-resources: pods,taskruns,jobs
@@ -36,8 +36,8 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
-          cache-dependency-path: "${{ github.workspace }}/src/github.com/tektoncd/chains/go.sum"
-          go-version-file: "${{ github.workspace }}/src/github.com/tektoncd/chains/go.mod"
+        cache-dependency-path: "${{ github.workspace }}/src/github.com/tektoncd/chains/go.sum"
+        go-version-file: "${{ github.workspace }}/src/github.com/tektoncd/chains/go.mod"
 
     - name: setup microshift
       run: |
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-bee7519eb20a587f8e063ff2016725970c1d1b7c`
	`1`	`+a51457de691e0edb45a4588a8e0c85cfa9df16eb`