stackrox · tommartensen · Jan 8, 2025 · Dec 11, 2024 · Dec 11, 2024 · Dec 11, 2024
@@ -75,6 +75,9 @@ jobs:
     - name: Check Policies
       run: scripts/ci/jobs/policy-checks.sh
 
+    - name: Check Konflux pipelines
+      run: scripts/ci/jobs/check-konflux-pipelines.sh
+
   style-check:
     runs-on: ubuntu-latest
     container:

@@ -230,6 +230,9 @@ spec:
   - description: ""
     name: JAVA_COMMUNITY_DEPENDENCIES
     value: $(tasks.build-container.results.JAVA_COMMUNITY_DEPENDENCIES)
+  - description: ""
+    name: SNAPSHOT_NAME
+    value: $(tasks.create-acs-style-snapshot.results.SNAPSHOT_NAME)
 
   workspaces:
   - name: git-auth
@@ -348,7 +351,7 @@ spec:
       - name: name
         value: wait-for-image
       - name: bundle
-        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:886e1482c717078d11ba7c5d6fc4e8013e3740b4d1282ebe5534db62c9f19428
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:3811d015320129588caf7629533a5b51b8c405b3b92e8d37165384f6750f9b66
       - name: kind
         value: task
       resolver: bundles
@@ -660,3 +663,131 @@ spec:
       - name: kind
         value: task
       resolver: bundles
+
+  - name: create-acs-style-snapshot
+    description: Creates a Snapshot representing a valid set of ACS containers unlike the Snapshots created by Konflux automatically
+    # Explicitly running after all other tasks to ensure that
+    # - there are no failures that should prevent a release of the operator-bundle image (missing RPMs signatures, deprecated base images, ...)
+    # - the source image is present as it is required by EC
+    # Use scripts/ci/jobs/check-konflux-pipelines.sh to validate and update the list.
+    runAfter:
+    - apply-tags
+    - build-container
+    - build-source-image
+    - clair-scan
+    - clamav-scan
+    - clone-repository
+    - deprecated-base-image-check
+    - determine-main-image-tag
+    - determine-operator-image-tag
+    - init
+    - prefetch-dependencies
+    - push-dockerfile
+    - rpms-signature-scan
+    - sast-snyk-check
+    - wait-for-central-db-image
+    - wait-for-collector-full-image
+    - wait-for-collector-slim-image
+    - wait-for-main-image
+    - wait-for-operator-image
+    - wait-for-roxctl-image
+    - wait-for-scanner-db-image
+    - wait-for-scanner-db-slim-image
+    - wait-for-scanner-image
+    - wait-for-scanner-slim-image
+    - wait-for-scanner-v4-db-image
+    - wait-for-scanner-v4-image
+    params:
+    - name: PRODUCT_VERSION
+      value: $(tasks.determine-main-image-tag.results.IMAGE_TAG)
+    - name: COMPONENTS
+      value: |
+        [
+          {
+            "name": "central-db",
+            "containerImage": "$(params.central-db-image-build-repo)@$(tasks.wait-for-central-db-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-central-db-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-central-db-image.results.GIT_REF)"
+          },
+          {
+            "name": "collector",
+            "containerImage": "$(params.collector-full-image-build-repo)@$(tasks.wait-for-collector-full-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-collector-full-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-collector-full-image.results.GIT_REF)"
+          },
+          {
+            "name": "collector-slim",
+            "containerImage": "$(params.collector-slim-image-build-repo)@$(tasks.wait-for-collector-slim-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-collector-slim-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-collector-slim-image.results.GIT_REF)"
+          },
+          {
+            "name": "main",
+            "containerImage": "$(params.main-image-build-repo)@$(tasks.wait-for-main-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-main-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-main-image.results.GIT_REF)"
+          },
+          {
+            "name": "operator",
+            "containerImage": "$(params.operator-image-build-repo)@$(tasks.wait-for-operator-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-operator-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-operator-image.results.GIT_REF)"
+          },
+          {
+            "name": "operator-bundle",
+            "containerImage": "$(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST)",
+            "repository": "$(params.git-url)",
+            "revision": "$(params.revision)"
+          },
+          {
+            "name": "roxctl",
+            "containerImage": "$(params.roxctl-image-build-repo)@$(tasks.wait-for-roxctl-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-roxctl-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-roxctl-image.results.GIT_REF)"
+          },
+          {
+            "name": "scanner-db",
+            "containerImage": "$(params.scanner-db-image-build-repo)@$(tasks.wait-for-scanner-db-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-scanner-db-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-scanner-db-image.results.GIT_REF)"
+          },
+          {
+            "name": "scanner-db-slim",
+            "containerImage": "$(params.scanner-db-slim-image-build-repo)@$(tasks.wait-for-scanner-db-slim-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-scanner-db-slim-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-scanner-db-slim-image.results.GIT_REF)"
+          },
+          {
+            "name": "scanner",
+            "containerImage": "$(params.scanner-image-build-repo)@$(tasks.wait-for-scanner-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-scanner-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-scanner-image.results.GIT_REF)"
+          },
+          {
+            "name": "scanner-slim",
+            "containerImage": "$(params.scanner-slim-image-build-repo)@$(tasks.wait-for-scanner-slim-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-scanner-slim-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-scanner-slim-image.results.GIT_REF)"
+          },
+          {
+            "name": "scanner-v4-db",
+            "containerImage": "$(params.scanner-v4-db-image-build-repo)@$(tasks.wait-for-scanner-v4-db-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-scanner-v4-db-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-scanner-v4-db-image.results.GIT_REF)"
+          },
+          {
+            "name": "scanner-v4",
+            "containerImage": "$(params.scanner-v4-image-build-repo)@$(tasks.wait-for-scanner-v4-image.results.IMAGE_DIGEST)",
+            "repository": "$(tasks.wait-for-scanner-v4-image.results.GIT_REPO)",
+            "revision": "$(tasks.wait-for-scanner-v4-image.results.GIT_REF)"
+          }
+        ]
+    taskRef:
+      params:
+      - name: name
+        value: create-snapshot
+      - name: bundle
+        value: quay.io/rhacs-eng/konflux-tasks:latest@sha256:3811d015320129588caf7629533a5b51b8c405b3b92e8d37165384f6750f9b66
+      - name: kind
+        value: task
+      resolver: bundles
diff --git a/scripts/ci/jobs/check-konflux-pipelines.sh b/scripts/ci/jobs/check-konflux-pipelines.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# This script is to ensure that modifications to our Konflux pipelines follow our expectations and conventions.
+# This script is intended to be run in CI
+
+set -euo pipefail
+
+ensure_create_snapshot_runs_last() {
+    local pipeline_path=".tekton/operator-bundle-pipeline.yaml"
+    local task_name="create-acs-style-snapshot"
+    expected_runafter="$(yq eval '.spec.tasks[] | select(.name != '\"${task_name}\"') | .name' "${pipeline_path}" | sort)"
+    actual_runafter="$(yq eval '.spec.tasks[] | select(.name == '\"${task_name}\"') | .runAfter[]' "${pipeline_path}")"
+
+    echo "➤ ${pipeline_path} // checking ${task_name}: task's runAfter contents shall match the expected ones (left - expected, right - actual)."
+    if ! diff --side-by-side <(echo "${expected_runafter}") <(echo "${actual_runafter}"); then
+        echo >&2 -e "
+✗ ERROR:
+
+The actual runAfter contents do not match the expectations.
+To resolve:
+
+1. Open ${pipeline_path} and locate the ${task_name} task
+2. Update the runAfter attribute of this task to this list of all previous tasks in the pipeline (sorted alphabetically):
+
+${expected_runafter}
+        "
+        exit 1
+    else
+        echo "✓ No diff detected."
+    fi
+}
+
+echo "Ensure consistency of our Konflux pipelines."
+ensure_create_snapshot_runs_last