Skip to content

add security tasks from bundle #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alexxfan wants to merge 1 commit into
base: rhai-helm-chart
Choose a base branch
from
Open

add security tasks from bundle #11

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
231 changes: 231 additions & 0 deletions .tekton/rhaii-helm-chart-poc-push.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ spec:
value: "charts/rhaii-helm-chart"
- name: hermetic
value: "false"
- name: rhoai-version
value: "3.4.0"
pipelineSpec:
description: |
Pipeline for building the RHOAI operator Helm chart as an OCI artifact.
Expand Down Expand Up @@ -68,6 +70,18 @@ spec:
description: Build a source image
name: build-source-image
type: string
- default: ''
description: RHOAI version of the form X.Y.Z (e.g., 3.2.1)
name: rhoai-version
type: string
- name: expected-cluster
default: ""
type: string
description: The cluster that this pipeline is expected to be run from
- description: Additional tags to push for build image
name: additional-tags
type: array
default: []
results:
- description: ""
name: IMAGE_URL
Expand All @@ -82,6 +96,23 @@ spec:
name: CHAINS-GIT_COMMIT
value: $(tasks.clone-repository.results.commit)
tasks:
- name: rhoai-init
params:
- name: expected-cluster
value: $(params.expected-cluster)
- name: rhoai-version
value: $(params.rhoai-version)
- name: image-output
value: $(params.output-image)
taskRef:
resolver: git
params:
- name: url
value: https://github.com/red-hat-data-services/rhoai-konflux-tasks.git
- name: revision
value: cd777af52bd87919ec2b494d460f671a840205d5
- name: pathInRepo
value: konflux-tekton-tasks/rhoai-init/0.1/rhoai-init.yaml
- name: init
taskRef:
params:
Expand All @@ -92,6 +123,8 @@ spec:
- name: kind
value: task
resolver: bundles
runAfter:
- rhoai-init
- name: clone-repository
params:
- name: url
Expand Down Expand Up @@ -191,6 +224,204 @@ spec:
operator: in
values:
- "true"
- name: sast-shell-check
params:
- name: image-digest
value: $(tasks.build-helm-chart.results.IMAGE_DIGEST)
- name: image-url
value: $(tasks.build-helm-chart.results.IMAGE_URL)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
runAfter:
- build-helm-chart
taskRef:
params:
- name: name
value: sast-shell-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:6f047f52c04ee6e4d2cb25af46e3ea92b235f6c5e02da540fb7ef0b90718bc0a
- name: kind
value: task
resolver: bundles
workspaces: []
- name: sast-unicode-check
params:
- name: image-url
value: $(tasks.build-helm-chart.results.IMAGE_URL)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
runAfter:
- build-helm-chart
taskRef:
params:
- name: name
value: sast-unicode-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.2@sha256:5a93fe7f1f3990167d87cb3f30bc13293e02cf5a6da88f46cf0368b3328c2d56
- name: kind
value: task
resolver: bundles
workspaces: []
- name: deprecated-base-image-check
params:
- name: IMAGE_URL
value: $(tasks.build-helm-chart.results.IMAGE_URL)
- name: IMAGE_DIGEST
value: $(tasks.build-helm-chart.results.IMAGE_DIGEST)
runAfter:
- build-helm-chart
taskRef:
params:
- name: name
value: deprecated-image-check
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:5ff16b7e6b4a8aa1adb352e74b9f831f77ff97bafd1b89ddb0038d63335f1a67
- name: kind
value: task
resolver: bundles
- name: clair-scan
params:
- name: image-digest
value: $(tasks.build-helm-chart.results.IMAGE_DIGEST)
- name: image-url
value: $(tasks.build-helm-chart.results.IMAGE_URL)
runAfter:
- build-helm-chart
taskRef:
params:
- name: name
value: clair-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.2@sha256:9fbf3bee160b727de7923a310160e6bcea60652573fc127ee98bf7507ff05b8c
- name: kind
value: task
resolver: bundles
- name: ecosystem-cert-preflight-checks
params:
- name: image-url
value: $(tasks.build-helm-chart.results.IMAGE_URL)
runAfter:
- build-helm-chart
taskRef:
params:
- name: name
value: ecosystem-cert-preflight-checks
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:b4ac586edea81dcd25dfc17f1bd57899825be2b443e48d572cd05ce058f153bb
- name: kind
value: task
resolver: bundles
- name: sast-snyk-check
params:
- name: image-digest
value: $(tasks.build-helm-chart.results.IMAGE_DIGEST)
- name: image-url
value: $(tasks.build-helm-chart.results.IMAGE_URL)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
runAfter:
- build-helm-chart
taskRef:
params:
- name: name
value: sast-snyk-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:d83becbfefe2aa39971c3d37bdc23489b745e22fd86cf4872455a133f8cb274f
- name: kind
value: task
resolver: bundles
- name: clamav-scan
params:
- name: image-digest
value: $(tasks.build-helm-chart.results.IMAGE_DIGEST)
- name: image-url
value: $(tasks.build-helm-chart.results.IMAGE_URL)
runAfter:
- build-helm-chart
taskRef:
params:
- name: name
value: clamav-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a
- name: kind
value: task
resolver: bundles
- name: apply-tags
params:
- name: IMAGE_URL
value: $(tasks.build-helm-chart.results.IMAGE_URL)
- name: IMAGE_DIGEST
value: $(tasks.build-helm-chart.results.IMAGE_DIGEST)
- name: ADDITIONAL_TAGS
value:
- $(params.additional-tags[*])
runAfter:
- build-helm-chart
taskRef:
params:
- name: name
value: apply-tags
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:aa62b41861c09e2e59c69cc6e9a1f740bf0c81e6a1eb03f57f59dfda0f65840e
- name: kind
value: task
resolver: bundles
- name: rpms-signature-scan
params:
- name: image-url
value: $(tasks.build-helm-chart.results.IMAGE_URL)
- name: image-digest
value: $(tasks.build-helm-chart.results.IMAGE_DIGEST)
runAfter:
- build-helm-chart
taskRef:
params:
- name: name
value: rpms-signature-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:3d48fa2fcc898bae9ce730a71789c34758a767b44bc36fd24938779deef4ee96
- name: kind
value: task
resolver: bundles
- name: pipeline-success-indicator
runAfter:
- build-source-image
- sast-shell-check
- sast-unicode-check
- deprecated-base-image-check
- clair-scan
- ecosystem-cert-preflight-checks
- sast-snyk-check
- clamav-scan
- apply-tags
- rpms-signature-scan
taskSpec:
steps:
- name: noop
image: quay.io/rhoai-konflux/alpine:latest
script: |
echo "Success"
finally:
- name: show-sbom
params:
- name: IMAGE_URL
value: $(tasks.build-helm-chart.results.IMAGE_URL)
taskRef:
params:
- name: name
value: show-sbom
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:04994df487ee886adbe60a8a5866647fbdfd53cc26f7b2554272ba51bf7af29e
- name: kind
value: task
resolver: bundles
workspaces:
- name: git-auth
optional: true
Expand Down
Loading