feat: onboard sigstore-a2a to Konflux with agent-card-validation stream

[sampras343]

Summary

• Add Konflux project overlay for sigstore-a2a under konflux-configs/base/project/overlay/sigstore-a2a/ following the model-transparency-go pattern
• Create agent-card-validation stream group under konflux-configs/base/stream/agent-card-validation/ with a main stream
• Component points to securesign/sigstore-a2a repo with Containerfile.rh for builds
• ImageRepository configured in rhtas-tenant with Bombino SBOM webhook
• EC integration test and ReleasePlan included via shared kustomize components
• Validated: kustomize build renders 376 resources with no errors

Files

Project overlay (4 files):

• project.yaml — Project definition
• template.yaml — ProjectDevelopmentStreamTemplate with variables
• patch/sigstore-a2a.yaml — Component + ImageRepository patch
• kustomization.yaml — wires it all together with EC and ReleasePlan

Stream group (5 files):

• base/sigstore-a2a.yaml — ProjectDevelopmentStream for main branch
• base/kustomization.yaml — Component listing
• overlay/main/ — main stream with kustomize nameReference config
• overlay/kustomization.yaml — overlay entry point

Modified (2 files):

• base/project/kustomization.yaml — added overlay/sigstore-a2a
• base/stream/kustomization.yaml — added agent-card-validation/overlay

Implements SECURESIGN-4635

[github-actions]

Configuration Diff

3 document(s) impacted:

+ 3 added
- 0 removed
! 0 modified

Diff

@@ (root level) @@
# projctl.konflux.dev/v1beta1/Project/rhtas-tenant/sigstore-a2a
! + one document added:
+   ---
+   apiVersion: projctl.konflux.dev/v1beta1
+   kind: Project
+   metadata:
+     name: sigstore-a2a
+     namespace: rhtas-tenant
+   spec:
+     description: |
+       sigstore-a2a - Keyless signing library for A2A Agent Cards using Sigstore and SLSA provenance.
+       
+     displayName: "Red Hat Trusted Artifact Signer sigstore-a2a"

@@ (root level) @@
# projctl.konflux.dev/v1beta1/ProjectDevelopmentStream/rhtas-tenant/sigstore-a2a-main
! + one document added:
+   ---
+   apiVersion: projctl.konflux.dev/v1beta1
+   kind: ProjectDevelopmentStream
+   metadata:
+     name: sigstore-a2a-main
+     namespace: rhtas-tenant
+   spec:
+     project: sigstore-a2a
+     template:
+       name: sigstore-a2a-template
+       values:
+       - name: version
+         value: main
+       - name: branch
+         value: main
+       - name: nameSuffix
+         value:

@@ (root level) @@
# projctl.konflux.dev/v1beta1/ProjectDevelopmentStreamTemplate/rhtas-tenant/sigstore-a2a-template
! + one document added:
+   ---
+   apiVersion: projctl.konflux.dev/v1beta1
+   kind: ProjectDevelopmentStreamTemplate
+   metadata:
+     name: sigstore-a2a-template
+     namespace: rhtas-tenant
+     labels:
+       build.rhtas.com/ec: registry-rhtas
+       build.rhtas.com/type: component
+   spec:
+     resources:
+     - apiVersion: appstudio.redhat.com/v1alpha1
+       kind: Application
+       metadata:
+         name: {{.application}}{{.nameSuffix}}
+         annotations:
+           application.thumbnail: 5
+       spec:
+         displayName: "{{.application}} ({{.version}})"
+     - apiVersion: appstudio.redhat.com/v1beta2
+       kind: IntegrationTestScenario
+       metadata:
+         name: {{.application}}{{.nameSuffix}}-enterprise-contract
+         annotations:
+           test.appstudio.openshift.io/kind: enterprise-contract
+       spec:
+         application: {{.application}}{{.nameSuffix}}
+         params:
+         - name: POLICY_CONFIGURATION
+           value: rhtap-releng-tenant/registry-rhtas
+         resolverRef:
+           params:
+           - name: url
+             value: "https://github.com/konflux-ci/build-definitions"
+           - name: revision
+             value: main
+           - name: pathInRepo
+             value: pipelines/enterprise-contract.yaml
+           resolver: git
+           resourceKind: pipeline
+     - apiVersion: appstudio.redhat.com/v1alpha1
+       kind: ReleasePlan
+       metadata:
+         name: promote-to-candidate-{{.application}}{{.nameSuffix}}
+         labels:
+           release.appstudio.openshift.io/auto-release: "true"
+           release.appstudio.openshift.io/standing-attribution: "true"
+       spec:
+         application: {{.application}}{{.nameSuffix}}
+         tenantPipeline:
+           params:
+           - name: git-url
+             value: "https://github.com/securesign/releases"
+           - name: revision
+             value: RHTAS-build-bot_candidate-images-{{.version}}
+           - name: code-freeze
+             value: "false"
+           - name: type
+             value: component
+           pipelineRef:
+             params:
+             - name: url
+               value: "https://github.com/securesign/pipelines"
+             - name: revision
+               value: main
+             - name: pathInRepo
+               value: pipelines/promote-to-candidate.yaml
+             resolver: git
+           serviceAccountName: rhtas-build-bot
+     - apiVersion: appstudio.redhat.com/v1alpha1
+       kind: Component
+       metadata:
+         name: sigstore-a2a{{.nameSuffix}}
+         annotations:
+           build.appstudio.openshift.io/pipeline: "{\"name\":\"docker-build-oci-ta\",\"bundle\":\"latest\"}"
+           git-provider: github
+           git-provider-url: "https://github.com"
+           mintmaker.appstudio.redhat.com/disabled: {{.mintmakerDisabled}}
+       spec:
+         source:
+           git:
+             url: "https://github.com/securesign/sigstore-a2a"
+             dockerfileUrl: Containerfile.rh
+             revision: {{.branch}}
+         application: {{.application}}{{.nameSuffix}}
+         componentName: sigstore-a2a
+     - apiVersion: appstudio.redhat.com/v1alpha1
+       kind: ImageRepository
+       metadata:
+         name: sigstore-a2a{{.nameSuffix}}
+         annotations:
+           image-controller.appstudio.redhat.com/update-component-image: "true"
+         labels:
+           appstudio.redhat.com/application: {{.application}}{{.nameSuffix}}
+           appstudio.redhat.com/component: sigstore-a2a{{.nameSuffix}}
+       spec:
+         image:
+           name: rhtas-tenant/sigstore-a2a
+           visibility: public
+         notifications:
+         - config:
+             url: "https://bombino.api.redhat.com/v1/sbom/quay/push"
+           event: repo_push
+           method: webhook
+           title: SBOM-event-to-Bombino
+     project: sigstore-a2a
+     variables:
+     - name: version
+       description: "A version number for a new development stream"
+     - name: branch
+       defaultValue: main
+       description: "Git branch"
+     - name: nameSuffix
+       defaultValue: "-{{hyphenize .version}}"
+       description: "A suffix which will be added to K8s resource name"
+     - name: application
+       defaultValue: sigstore-a2a
+       description: "The application name"
+     - name: mintmakerDisabled
+       defaultValue: "false"
+       description: "Whether to disable mintmaker annotation on the Component"

---

_{📦 Artifacts: base-output.yaml, head-output.yaml, dyff-output.txt}

[JasonPowr]

LGTM!