diff --git a/.konflux/applications/serverless-operator-140/components/imagerepositories/kn-plugin-func-func-util-123.yaml b/.konflux/applications/serverless-operator-140/components/imagerepositories/kn-plugin-func-func-util-123.yaml new file mode 100755 index 0000000000..66a565dd5a --- /dev/null +++ b/.konflux/applications/serverless-operator-140/components/imagerepositories/kn-plugin-func-func-util-123.yaml @@ -0,0 +1,13 @@ +apiVersion: appstudio.redhat.com/v1alpha1 +kind: ImageRepository +metadata: + annotations: + image-controller.appstudio.redhat.com/update-component-image: "true" + labels: + appstudio.redhat.com/application: serverless-operator-140 + appstudio.redhat.com/component: kn-plugin-func-func-util-123 + name: kn-plugin-func-func-util-123 +spec: + image: + name: serverless-operator-140/kn-plugin-func-func-util + visibility: public diff --git a/.konflux/applications/serverless-operator-140/components/kn-plugin-func-func-util-123.yaml b/.konflux/applications/serverless-operator-140/components/kn-plugin-func-func-util-123.yaml new file mode 100755 index 0000000000..261f6d0889 --- /dev/null +++ b/.konflux/applications/serverless-operator-140/components/kn-plugin-func-func-util-123.yaml @@ -0,0 +1,16 @@ +apiVersion: appstudio.redhat.com/v1alpha1 +kind: Component +metadata: + annotations: + build.appstudio.openshift.io/pipeline: '{"name":"docker-build","bundle":"latest"}' + build.appstudio.openshift.io/request: configure-pac-no-mr + name: kn-plugin-func-func-util-123 +spec: + componentName: kn-plugin-func-func-util-123 + application: serverless-operator-140 + source: + git: + url: https://github.com/openshift-knative/kn-plugin-func.git + context: + dockerfileUrl: openshift/ci-operator/knative-images/func-util/Dockerfile + revision: release-v1.23 diff --git a/.tekton/docker-build.yaml b/.tekton/docker-build.yaml new file mode 100755 index 0000000000..8bafd6d6ea --- /dev/null +++ b/.tekton/docker-build.yaml @@ -0,0 +1,571 @@ +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + labels: + pipelines.openshift.io/runtime: generic + pipelines.openshift.io/strategy: docker + pipelines.openshift.io/used-by: build-cloud + name: docker-build +spec: + description: | + This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. + + _Uses `buildah` to create a multi-platform container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. This pipeline requires that the [multi platform controller](https://github.com/konflux-ci/multi-platform-controller) is deployed and configured on your Konflux instance. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. + This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-multi-platform-oci-ta?tab=tags)_ + params: + - default: + - linux/x86_64 + - linux/arm64 + - linux/ppc64le + - linux/s390x + description: List of platforms to build the container images on. The available + set of values is determined by the configuration of the multi-platform-controller. + name: build-platforms + type: array + - default: --all-projects --org=3e1a4cca-ebfb-495f-b64c-3cc960d566b4 --exclude=test*,vendor,third_party + description: Append arguments to Snyk code command. + name: snyk-args + type: string + - default: "true" + description: Build a source image. + name: build-source-image + type: string + - default: "false" + description: 'Enable in-development package managers. WARNING: the behavior may + change at any time without notice. Use at your own risk.' + name: prefetch-input-dev-package-managers + - default: [] + description: Additional image tags + name: additional-tags + type: array + - description: Source Repository URL + name: git-url + type: string + - default: "" + description: Revision of the Source Repository + name: revision + type: string + - description: Fully Qualified Output Image + name: output-image + type: string + - default: . + description: Path to the source code of an application's component from where + to build image. + name: path-context + type: string + - default: Dockerfile + description: Path to the Dockerfile inside the context specified by parameter + path-context + name: dockerfile + type: string + - default: "false" + description: Skip checks against built image + name: skip-checks + type: string + - default: "false" + description: Execute the build with network isolation + name: hermetic + type: string + - default: "" + description: Build dependencies to be prefetched + name: prefetch-input + type: string + - default: "" + description: Image tag expiration time, time values could be something like 1h, + 2d, 3w for hours, days, and weeks, respectively. + name: image-expires-after + type: string + - default: "true" + description: Add built image into an OCI image index + name: build-image-index + type: string + - default: docker + description: The format for the resulting image's mediaType. Valid values are + oci or docker. + name: buildah-format + type: string + - default: "false" + description: Enable cache proxy configuration + name: enable-cache-proxy + - default: "true" + description: Use the package registry proxy when prefetching dependencies + name: enable-package-registry-proxy + - default: . + description: Target directories in component's source code to scan with SAST tools. + Multiple values should be separated with commas. + name: sast-target-dirs + type: string + - default: [] + description: Array of --build-arg values ("arg=value" strings) for buildah + name: build-args + type: array + - default: "" + description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file + name: build-args-file + type: string + - default: "false" + description: Whether to enable privileged mode, should be used only with remote + VMs + name: privileged-nested + type: string + - default: "" + description: Sets the image created time and the SOURCE_DATE_EPOCH build argument. + On its own, it does not change file timestamps inside the layers (set rewrite-timestamp + to "true" for that). Leave empty to keep the actual build time. + name: source-date-epoch + type: string + - default: "false" + description: When "true", clamp file modification times in the image layers to + at most source-date-epoch. Does nothing unless source-date-epoch is set. + name: rewrite-timestamp + type: string + - default: "false" + description: When "true", omit the build history (history timestamps, layer metadata, + etc.) from the resulting image. + name: omit-history + type: string + results: + - description: "" + name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - description: "" + name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - description: "" + name: CHAINS-GIT_URL + value: $(tasks.clone-repository.results.url) + - description: "" + name: CHAINS-GIT_COMMIT + value: $(tasks.clone-repository.results.commit) + tasks: + - name: sast-snyk-check + params: + - name: ARGS + value: $(params.snyk-args) + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-snyk-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:eba24f5d9f4b18aa71e523b9b3dbcf22982aa4b018824260a090b19dfc9abf6f + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: prefetch-dependencies + params: + - name: dev-package-managers + value: $(params.prefetch-input-dev-package-managers) + - name: input + value: $(params.prefetch-input) + - name: enable-package-registry-proxy + value: $(params.enable-package-registry-proxy) + - name: SOURCE_ARTIFACT + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + - name: ociStorage + value: $(params.output-image).prefetch + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - clone-repository + taskRef: + params: + - name: name + value: prefetch-dependencies-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.10.1@sha256:c09c1c3ced67fb8740b2925a7de09c0810d4e8c8f148d41c21ffe37810d85c62 + - name: kind + value: task + resolver: bundles + workspaces: + - name: git-basic-auth + workspace: git-auth + - name: netrc + workspace: netrc + - name: apply-tags + params: + - name: ADDITIONAL_TAGS + value: $(params.additional-tags[*]) + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: apply-tags + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6 + - name: kind + value: task + resolver: bundles + - name: init + params: + - name: enable-cache-proxy + value: $(params.enable-cache-proxy) + taskRef: + params: + - name: name + value: init + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db + - name: kind + value: task + resolver: bundles + - name: clone-repository + params: + - name: url + value: $(params.git-url) + - name: revision + value: $(params.revision) + - name: ociStorage + value: $(params.output-image).git + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - init + taskRef: + params: + - name: name + value: git-clone-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.4@sha256:df3c42d78223f07b40a84dd29e5c8860d14777ffdf150ea08c738770f51216dc + - name: kind + value: task + resolver: bundles + workspaces: + - name: basic-auth + workspace: git-auth + - matrix: + params: + - name: PLATFORM + value: + - $(params.build-platforms) + name: build-images + params: + - name: IMAGE + value: $(params.output-image) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: HERMETIC + value: $(params.hermetic) + - name: PREFETCH_INPUT + value: $(params.prefetch-input) + - name: IMAGE_EXPIRES_AFTER + value: $(params.image-expires-after) + - name: COMMIT_SHA + value: $(tasks.clone-repository.results.commit) + - name: BUILD_ARGS + value: + - $(params.build-args[*]) + - name: BUILD_ARGS_FILE + value: $(params.build-args-file) + - name: PRIVILEGED_NESTED + value: $(params.privileged-nested) + - name: SOURCE_URL + value: $(tasks.clone-repository.results.url) + - name: BUILDAH_FORMAT + value: $(params.buildah-format) + - name: HTTP_PROXY + value: $(tasks.init.results.http-proxy) + - name: NO_PROXY + value: $(tasks.init.results.no-proxy) + - name: SOURCE_DATE_EPOCH + value: $(params.source-date-epoch) + - name: REWRITE_TIMESTAMP + value: $(params.rewrite-timestamp) + - name: OMIT_HISTORY + value: $(params.omit-history) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + - name: IMAGE_APPEND_PLATFORM + value: "true" + runAfter: + - prefetch-dependencies + taskRef: + params: + - name: name + value: buildah-remote-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.10.5@sha256:eb277ec7b44443f0506a60ac940a2e52178d60f17cb0f51a6966daed5b3755de + - name: kind + value: task + resolver: bundles + - name: build-image-index + params: + - name: IMAGE + value: $(params.output-image) + - name: ALWAYS_BUILD_INDEX + value: $(params.build-image-index) + - name: IMAGES + value: + - $(tasks.build-images.results.IMAGE_REF[*]) + - name: BUILDAH_FORMAT + value: $(params.buildah-format) + runAfter: + - build-images + taskRef: + params: + - name: name + value: build-image-index + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:cc75f64deecccb1b59e96ac1182665a5342d79c9e22eebff63d26b0f00a4319c + - name: kind + value: task + resolver: bundles + - name: build-source-image + params: + - name: BINARY_IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: BINARY_IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: source-build-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:7c5575ac8e292f27f57716c021ab0324460dc958e73946724c588c5228e5f372 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.build-source-image) + operator: in + values: + - "true" + - name: deprecated-base-image-check + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: deprecated-image-check + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: image-platform + value: + - $(params.build-platforms) + name: roxctl-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: roxctl-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-roxctl-scan:0.1@sha256:97e2b2cdca9110fdc8a93ba585a1a1a743f989f2fd85f4073f6e5ea9ad2ce828 + - name: kind + value: task + resolver: bundles + timeout: 20m + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: platform + value: + - $(params.build-platforms) + name: ecosystem-cert-preflight-checks + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: ecosystem-cert-preflight-checks + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:c07d2befa8abf48d4a223a5bdf5ea2335e756d4d0bbc422761087c263060aa94 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: image-arch + value: + - $(params.build-platforms) + name: clamav-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clamav-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-shell-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-shell-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:61b27e6ad5daba761d41bb37efb790ed98380603fd4fe2f86d156def5bd72ecc + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-unicode-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-unicode-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:eb9d5392f215cb8b52b16382098cac4885b1e6cd989f88ebd83fdb234d283eb9 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: push-dockerfile + params: + - name: IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: push-dockerfile-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:5a6cbebd89e5bc163b38231859767f7f6a0dd66cf1333699574379f062731183 + - name: kind + value: task + resolver: bundles + - name: rpms-signature-scan + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: rpms-signature-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:f110c53fd58cab7ac6e47d472bb801d49e2f584eb31837db9d611e11b3862a3d + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + workspaces: + - name: git-auth + optional: true + - name: netrc + optional: true diff --git a/.tekton/kn-plugin-func-func-util-123-pull-request.yaml b/.tekton/kn-plugin-func-func-util-123-pull-request.yaml new file mode 100755 index 0000000000..21a6222c95 --- /dev/null +++ b/.tekton/kn-plugin-func-func-util-123-pull-request.yaml @@ -0,0 +1,65 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + annotations: + build.appstudio.openshift.io/repo: https://github.com/openshift-knative/kn-plugin-func?rev={{revision}} + build.appstudio.redhat.com/commit_sha: '{{revision}}' + build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' + build.appstudio.redhat.com/target_branch: '{{target_branch}}' + pipelinesascode.tekton.dev/max-keep-runs: "3" + pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch == "release-v1.23" + creationTimestamp: null + labels: + appstudio.openshift.io/application: serverless-operator-140 + appstudio.openshift.io/component: kn-plugin-func-func-util-123 + pipelines.appstudio.openshift.io/type: build + name: kn-plugin-func-func-util-123-on-pull-request + namespace: ocp-serverless-tenant +spec: + params: + - name: dockerfile + value: openshift/ci-operator/knative-images/func-util/Dockerfile + - name: build-args + value: + - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts-rhel9:v4.16 + - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26 + - GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal + - JAVA_BUILDER=registry.access.redhat.com/ubi9/openjdk-21 + - JAVA_RUNTIME=registry.access.redhat.com/ubi9/openjdk-21-runtime + - NODE_BUILDER=registry.access.redhat.com/ubi9/nodejs-20 + - NODE_RUNTIME=registry.access.redhat.com/ubi9/nodejs-20 + - VERSION=1.40.0 + - name: git-url + value: '{{source_url}}' + - name: hermetic + value: "true" + - name: image-expires-after + value: 5d + - name: output-image + value: quay.io/redhat-user-workloads/ocp-serverless-tenant/serverless-operator-140/kn-plugin-func-func-util:on-pr-{{revision}} + - name: build-platforms + value: + - linux/x86_64 + - name: revision + value: '{{revision}}' + - name: prefetch-input + value: '[{"type":"rpm"},{"path":".","type":"gomod"}]' + - name: prefetch-input-dev-package-managers + value: 'true' + taskRunSpecs: + - pipelineTaskName: sast-shell-check + stepSpecs: + - name: sast-shell-check + computeResources: + requests: + memory: 4Gi + limits: + memory: 4Gi + pipelineRef: + name: docker-build + taskRunTemplate: + serviceAccountName: build-pipeline-kn-plugin-func-func-util-123 + workspaces: + - name: git-auth + secret: + secretName: '{{ git_auth_secret }}' diff --git a/.tekton/kn-plugin-func-func-util-123-push.yaml b/.tekton/kn-plugin-func-func-util-123-push.yaml new file mode 100755 index 0000000000..c83ec22ccf --- /dev/null +++ b/.tekton/kn-plugin-func-func-util-123-push.yaml @@ -0,0 +1,64 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + annotations: + build.appstudio.openshift.io/repo: https://github.com/openshift-knative/kn-plugin-func?rev={{revision}} + build.appstudio.redhat.com/commit_sha: '{{revision}}' + build.appstudio.redhat.com/target_branch: '{{target_branch}}' + pipelinesascode.tekton.dev/max-keep-runs: "3" + pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "release-v1.23" + creationTimestamp: null + labels: + appstudio.openshift.io/application: serverless-operator-140 + appstudio.openshift.io/component: kn-plugin-func-func-util-123 + pipelines.appstudio.openshift.io/type: build + name: kn-plugin-func-func-util-123-on-push + namespace: ocp-serverless-tenant +spec: + params: + - name: dockerfile + value: openshift/ci-operator/knative-images/func-util/Dockerfile + - name: build-args + value: + - CLI_ARTIFACTS=registry.redhat.io/openshift4/ose-cli-artifacts-rhel9:v4.16 + - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26 + - GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal + - JAVA_BUILDER=registry.access.redhat.com/ubi9/openjdk-21 + - JAVA_RUNTIME=registry.access.redhat.com/ubi9/openjdk-21-runtime + - NODE_BUILDER=registry.access.redhat.com/ubi9/nodejs-20 + - NODE_RUNTIME=registry.access.redhat.com/ubi9/nodejs-20 + - VERSION=1.40.0 + - name: git-url + value: '{{source_url}}' + - name: hermetic + value: "true" + - name: output-image + value: quay.io/redhat-user-workloads/ocp-serverless-tenant/serverless-operator-140/kn-plugin-func-func-util:{{revision}} + - name: revision + value: '{{revision}}' + - name: additional-tags + value: + - $(context.pipelineRun.uid)-{{revision}} + - 1.40.0 + - latest + - name: prefetch-input + value: '[{"type":"rpm"},{"path":".","type":"gomod"}]' + - name: prefetch-input-dev-package-managers + value: 'true' + taskRunSpecs: + - pipelineTaskName: sast-shell-check + stepSpecs: + - name: sast-shell-check + computeResources: + requests: + memory: 4Gi + limits: + memory: 4Gi + pipelineRef: + name: docker-build + taskRunTemplate: + serviceAccountName: build-pipeline-kn-plugin-func-func-util-123 + workspaces: + - name: git-auth + secret: + secretName: '{{ git_auth_secret }}' diff --git a/openshift/ci-operator/build-image/Dockerfile b/openshift/ci-operator/build-image/Dockerfile index 54684da50b..24aafa3313 100755 --- a/openshift/ci-operator/build-image/Dockerfile +++ b/openshift/ci-operator/build-image/Dockerfile @@ -3,7 +3,7 @@ FROM registry.ci.openshift.org/ocp/4.19:cli-artifacts as tools # Dockerfile to bootstrap build and test in openshift-ci -FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.21 as builder +FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-4.23 as builder ARG TARGETARCH diff --git a/openshift/ci-operator/knative-images/func-util/Dockerfile b/openshift/ci-operator/knative-images/func-util/Dockerfile index 843a1ab34e..d1753c967c 100755 --- a/openshift/ci-operator/knative-images/func-util/Dockerfile +++ b/openshift/ci-operator/knative-images/func-util/Dockerfile @@ -1,5 +1,5 @@ # DO NOT EDIT! Generated Dockerfile for cmd/func-util. -ARG GO_BUILDER=registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.21 +ARG GO_BUILDER=registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-4.23 ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal FROM $GO_BUILDER as builder @@ -15,7 +15,7 @@ RUN go build -tags strictfipsruntime,exclude_graphdriver_btrfs -o /usr/bin/main FROM $GO_RUNTIME -ARG VERSION=knative-nightly +ARG VERSION=knative-v1.23 RUN microdnf install -y socat tar @@ -41,6 +41,6 @@ LABEL \ io.openshift.tags="func-util" \ vendor="Red Hat, Inc." \ release=$VERSION \ - cpe="cpe:/a:redhat:openshift_serverless:::el9" + cpe="cpe:/a:redhat:openshift_serverless:1.40::el9" ENTRYPOINT ["/usr/bin/bash"] diff --git a/openshift/images.yaml b/openshift/images.yaml index c6b97ff23a..7d4ef32fbb 100755 --- a/openshift/images.yaml +++ b/openshift/images.yaml @@ -1 +1 @@ -knative.dev/func/cmd/func-util: registry.ci.openshift.org/openshift/knative-kn-plugin-func-func-util:knative-nightly +knative.dev/func/cmd/func-util: registry.ci.openshift.org/openshift/knative-kn-plugin-func-func-util:knative-v1.23 diff --git a/rpms.lock.yaml b/rpms.lock.yaml index f116e4e25e..3573774f25 100644 --- a/rpms.lock.yaml +++ b/rpms.lock.yaml @@ -18,20 +18,20 @@ arches: name: rsync evr: 3.2.5-7.el9_8.2 sourcerpm: rsync-3.2.5-7.el9_8.2.src.rpm - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/t/tar-1.34-11.el9.aarch64.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/t/tar-1.34-13.el9_8.aarch64.rpm repoid: ubi-9-for-aarch64-baseos-rpms - size: 904777 - checksum: sha256:62f985a87e048caa3ef883966d6176448398abc42df00ebff07e7311ff5f425d + size: 909271 + checksum: sha256:ee4fa57c4bb87613f6fbd4b785a9e6162d43f046d1bbdd5022771652b931e9d0 name: tar - evr: 2:1.34-11.el9 - sourcerpm: tar-1.34-11.el9.src.rpm - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/t/tzdata-2026b-1.el9.noarch.rpm + evr: 2:1.34-13.el9_8 + sourcerpm: tar-1.34-13.el9_8.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/t/tzdata-2026c-1.el9_8.noarch.rpm repoid: ubi-9-for-aarch64-baseos-rpms - size: 933841 - checksum: sha256:09908fa480ac8a56488cde728503cd47a01ed0b717ee00b4233d386784f62793 + size: 933286 + checksum: sha256:8d6196e02853c0900c3c2e2367665beffb62cb2d0ff5f465ea2d00848a9a35dc name: tzdata - evr: 2026b-1.el9 - sourcerpm: tzdata-2026b-1.el9.src.rpm + evr: 2026c-1.el9_8 + sourcerpm: tzdata-2026c-1.el9_8.src.rpm - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/u/unzip-6.0-60.el9.aarch64.rpm repoid: ubi-9-for-aarch64-baseos-rpms size: 182733 @@ -59,18 +59,18 @@ arches: checksum: sha256:37d0ee99d570df9eadf8244580dc078258ae4c9833ca3458cb6dc5851a7c37ca name: rsync evr: 3.2.5-7.el9_8.2 - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/t/tar-1.34-11.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/t/tar-1.34-13.el9_8.src.rpm repoid: ubi-9-for-aarch64-baseos-source-rpms - size: 2294162 - checksum: sha256:13204f7499944b3fe773cbdf0b9bb2de31eaa9a4c69f31830fb9e54506bcb9b6 + size: 2312101 + checksum: sha256:15eeffee75eaef17e056cef4d5207825782a755db6dfd509a759e672ffd03b6c name: tar - evr: 2:1.34-11.el9 - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/t/tzdata-2026b-1.el9.src.rpm + evr: 2:1.34-13.el9_8 + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/t/tzdata-2026c-1.el9_8.src.rpm repoid: ubi-9-for-aarch64-baseos-source-rpms - size: 929993 - checksum: sha256:d549fc081c8cb2eec6c8273acfdd1b24023897c09fff24117fe2c2532d4bf085 + size: 933774 + checksum: sha256:4cc10832b19807c03a30bd9317fb37dc811d2f13c11b1ed35af8d2efa481622f name: tzdata - evr: 2026b-1.el9 + evr: 2026c-1.el9_8 - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/u/unzip-6.0-60.el9.src.rpm repoid: ubi-9-for-aarch64-baseos-source-rpms size: 1436236 @@ -100,20 +100,20 @@ arches: name: rsync evr: 3.2.5-7.el9_8.2 sourcerpm: rsync-3.2.5-7.el9_8.2.src.rpm - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/os/Packages/t/tar-1.34-11.el9.ppc64le.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/os/Packages/t/tar-1.34-13.el9_8.ppc64le.rpm repoid: ubi-9-for-ppc64le-baseos-rpms - size: 945887 - checksum: sha256:cb2fe4ca6c89e1a9fff648629cc7b9b7f33a7853a8ae74c10baa1d5b731d2447 + size: 947907 + checksum: sha256:d1edfa14f40d3556861be567c693a18cf025f7d1a1e041142a8a7cae6f7b32f7 name: tar - evr: 2:1.34-11.el9 - sourcerpm: tar-1.34-11.el9.src.rpm - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/os/Packages/t/tzdata-2026b-1.el9.noarch.rpm + evr: 2:1.34-13.el9_8 + sourcerpm: tar-1.34-13.el9_8.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/os/Packages/t/tzdata-2026c-1.el9_8.noarch.rpm repoid: ubi-9-for-ppc64le-baseos-rpms - size: 933841 - checksum: sha256:09908fa480ac8a56488cde728503cd47a01ed0b717ee00b4233d386784f62793 + size: 933286 + checksum: sha256:8d6196e02853c0900c3c2e2367665beffb62cb2d0ff5f465ea2d00848a9a35dc name: tzdata - evr: 2026b-1.el9 - sourcerpm: tzdata-2026b-1.el9.src.rpm + evr: 2026c-1.el9_8 + sourcerpm: tzdata-2026c-1.el9_8.src.rpm - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/os/Packages/u/unzip-6.0-60.el9.ppc64le.rpm repoid: ubi-9-for-ppc64le-baseos-rpms size: 190290 @@ -141,18 +141,18 @@ arches: checksum: sha256:37d0ee99d570df9eadf8244580dc078258ae4c9833ca3458cb6dc5851a7c37ca name: rsync evr: 3.2.5-7.el9_8.2 - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/source/SRPMS/Packages/t/tar-1.34-11.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/source/SRPMS/Packages/t/tar-1.34-13.el9_8.src.rpm repoid: ubi-9-for-ppc64le-baseos-source-rpms - size: 2294162 - checksum: sha256:13204f7499944b3fe773cbdf0b9bb2de31eaa9a4c69f31830fb9e54506bcb9b6 + size: 2312101 + checksum: sha256:15eeffee75eaef17e056cef4d5207825782a755db6dfd509a759e672ffd03b6c name: tar - evr: 2:1.34-11.el9 - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/source/SRPMS/Packages/t/tzdata-2026b-1.el9.src.rpm + evr: 2:1.34-13.el9_8 + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/source/SRPMS/Packages/t/tzdata-2026c-1.el9_8.src.rpm repoid: ubi-9-for-ppc64le-baseos-source-rpms - size: 929993 - checksum: sha256:d549fc081c8cb2eec6c8273acfdd1b24023897c09fff24117fe2c2532d4bf085 + size: 933774 + checksum: sha256:4cc10832b19807c03a30bd9317fb37dc811d2f13c11b1ed35af8d2efa481622f name: tzdata - evr: 2026b-1.el9 + evr: 2026c-1.el9_8 - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/source/SRPMS/Packages/u/unzip-6.0-60.el9.src.rpm repoid: ubi-9-for-ppc64le-baseos-source-rpms size: 1436236 @@ -182,20 +182,20 @@ arches: name: rsync evr: 3.2.5-7.el9_8.2 sourcerpm: rsync-3.2.5-7.el9_8.2.src.rpm - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/os/Packages/t/tar-1.34-11.el9.s390x.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/os/Packages/t/tar-1.34-13.el9_8.s390x.rpm repoid: ubi-9-for-s390x-baseos-rpms - size: 907745 - checksum: sha256:2eee88e1c470b033bd44432f4ed5b1a41ffc7132ebe51f8ce12fa9268314e841 + size: 910326 + checksum: sha256:811cba7426379544fd3fbf6e5a8638bed49132e447b0c536c91e6fd315fac6a0 name: tar - evr: 2:1.34-11.el9 - sourcerpm: tar-1.34-11.el9.src.rpm - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/os/Packages/t/tzdata-2026b-1.el9.noarch.rpm + evr: 2:1.34-13.el9_8 + sourcerpm: tar-1.34-13.el9_8.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/os/Packages/t/tzdata-2026c-1.el9_8.noarch.rpm repoid: ubi-9-for-s390x-baseos-rpms - size: 933841 - checksum: sha256:09908fa480ac8a56488cde728503cd47a01ed0b717ee00b4233d386784f62793 + size: 933286 + checksum: sha256:8d6196e02853c0900c3c2e2367665beffb62cb2d0ff5f465ea2d00848a9a35dc name: tzdata - evr: 2026b-1.el9 - sourcerpm: tzdata-2026b-1.el9.src.rpm + evr: 2026c-1.el9_8 + sourcerpm: tzdata-2026c-1.el9_8.src.rpm - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/os/Packages/u/unzip-6.0-60.el9.s390x.rpm repoid: ubi-9-for-s390x-baseos-rpms size: 180799 @@ -223,18 +223,18 @@ arches: checksum: sha256:37d0ee99d570df9eadf8244580dc078258ae4c9833ca3458cb6dc5851a7c37ca name: rsync evr: 3.2.5-7.el9_8.2 - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/source/SRPMS/Packages/t/tar-1.34-11.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/source/SRPMS/Packages/t/tar-1.34-13.el9_8.src.rpm repoid: ubi-9-for-s390x-baseos-source-rpms - size: 2294162 - checksum: sha256:13204f7499944b3fe773cbdf0b9bb2de31eaa9a4c69f31830fb9e54506bcb9b6 + size: 2312101 + checksum: sha256:15eeffee75eaef17e056cef4d5207825782a755db6dfd509a759e672ffd03b6c name: tar - evr: 2:1.34-11.el9 - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/source/SRPMS/Packages/t/tzdata-2026b-1.el9.src.rpm + evr: 2:1.34-13.el9_8 + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/source/SRPMS/Packages/t/tzdata-2026c-1.el9_8.src.rpm repoid: ubi-9-for-s390x-baseos-source-rpms - size: 929993 - checksum: sha256:d549fc081c8cb2eec6c8273acfdd1b24023897c09fff24117fe2c2532d4bf085 + size: 933774 + checksum: sha256:4cc10832b19807c03a30bd9317fb37dc811d2f13c11b1ed35af8d2efa481622f name: tzdata - evr: 2026b-1.el9 + evr: 2026c-1.el9_8 - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/source/SRPMS/Packages/u/unzip-6.0-60.el9.src.rpm repoid: ubi-9-for-s390x-baseos-source-rpms size: 1436236 @@ -264,20 +264,20 @@ arches: name: rsync evr: 3.2.5-7.el9_8.2 sourcerpm: rsync-3.2.5-7.el9_8.2.src.rpm - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/t/tar-1.34-11.el9.x86_64.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/t/tar-1.34-13.el9_8.x86_64.rpm repoid: ubi-9-for-x86_64-baseos-rpms - size: 913256 - checksum: sha256:58b622ab7bc225731a2473e677f16c9eb51b1ed218a86a7aa039a6fed665f245 + size: 914200 + checksum: sha256:913d84cd94463e3f0400d80c6742a2974eeab6445ac71ff9eb802a70779c146f name: tar - evr: 2:1.34-11.el9 - sourcerpm: tar-1.34-11.el9.src.rpm - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/t/tzdata-2026b-1.el9.noarch.rpm + evr: 2:1.34-13.el9_8 + sourcerpm: tar-1.34-13.el9_8.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/t/tzdata-2026c-1.el9_8.noarch.rpm repoid: ubi-9-for-x86_64-baseos-rpms - size: 933841 - checksum: sha256:09908fa480ac8a56488cde728503cd47a01ed0b717ee00b4233d386784f62793 + size: 933286 + checksum: sha256:8d6196e02853c0900c3c2e2367665beffb62cb2d0ff5f465ea2d00848a9a35dc name: tzdata - evr: 2026b-1.el9 - sourcerpm: tzdata-2026b-1.el9.src.rpm + evr: 2026c-1.el9_8 + sourcerpm: tzdata-2026c-1.el9_8.src.rpm - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/u/unzip-6.0-60.el9.x86_64.rpm repoid: ubi-9-for-x86_64-baseos-rpms size: 185941 @@ -305,18 +305,18 @@ arches: checksum: sha256:37d0ee99d570df9eadf8244580dc078258ae4c9833ca3458cb6dc5851a7c37ca name: rsync evr: 3.2.5-7.el9_8.2 - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/t/tar-1.34-11.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/t/tar-1.34-13.el9_8.src.rpm repoid: ubi-9-for-x86_64-baseos-source-rpms - size: 2294162 - checksum: sha256:13204f7499944b3fe773cbdf0b9bb2de31eaa9a4c69f31830fb9e54506bcb9b6 + size: 2312101 + checksum: sha256:15eeffee75eaef17e056cef4d5207825782a755db6dfd509a759e672ffd03b6c name: tar - evr: 2:1.34-11.el9 - - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/t/tzdata-2026b-1.el9.src.rpm + evr: 2:1.34-13.el9_8 + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/t/tzdata-2026c-1.el9_8.src.rpm repoid: ubi-9-for-x86_64-baseos-source-rpms - size: 929993 - checksum: sha256:d549fc081c8cb2eec6c8273acfdd1b24023897c09fff24117fe2c2532d4bf085 + size: 933774 + checksum: sha256:4cc10832b19807c03a30bd9317fb37dc811d2f13c11b1ed35af8d2efa481622f name: tzdata - evr: 2026b-1.el9 + evr: 2026c-1.el9_8 - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/u/unzip-6.0-60.el9.src.rpm repoid: ubi-9-for-x86_64-baseos-source-rpms size: 1436236