close-advisory-issues.yaml

---
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: close-advisory-issues
  annotations:
    tekton.dev/pipelines.minVersion: "0.12.1"
    tekton.dev/tags: release
spec:
  description: >
    Tekton task to close all issues referenced in the releaseNotes. It is meant to run after the advisory is published.
    A comment will be added to each closed issue with a link to the advisory it was fixed in.

    Note: This task currently only supports issues in redhat.atlassian.net and issues.redhat.com due to them requiring
    authentication. Issues in other servers will be skipped without the task failing.
  params:
    - name: dataPath
      description: Path to the JSON string of the merged data to use in the data workspace
      type: string
    - name: advisoryUrl
      description: The url of the advisory the issues were fixed in. This is added in a comment on the issue
      type: string
    - name: ociStorage
      description: The OCI repository where the Trusted Artifacts are stored
      type: string
      default: "empty"
    - name: ociArtifactExpiresAfter
      description: Expiration date for the trusted artifacts created in the
        OCI repository. An empty string means the artifacts do not expire
      type: string
      default: "1d"
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable
      type: string
      default: ""
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: ""
    - name: sourceDataArtifact
      type: string
      description: Location of trusted artifacts to be used to populate data directory
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
      default: /var/workdir/release
    - name: taskGitUrl
      type: string
      description: The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored
    - name: taskGitRevision
      type: string
      description: The revision in the taskGitUrl repo to be used
    - name: caTrustConfigMapName
      type: string
      description: The name of the ConfigMap to read CA bundle data from
      default: trusted-ca
    - name: caTrustConfigMapKey
      type: string
      description: The name of the key in the ConfigMap that contains the CA bundle data
      default: ca-bundle.crt
    - name: jiraSecretName
      type: string
      description: The name of the secret to use for Jira authentication, containing one key - token
      default: konflux-advisory-jira-secret
  results:
    - description: Produced trusted data artifact
      name: sourceDataArtifact
      type: string
  volumes:
    - name: workdir
      emptyDir: {}
    - name: access-token-secret-vol
      secret:
        secretName: $(params.jiraSecretName)
        defaultMode: 0444
    - name: trusted-ca
      configMap:
        name: $(params.caTrustConfigMapName)
        items:
          - key: $(params.caTrustConfigMapKey)
            path: ca-bundle.crt
        optional: true

  stepTemplate:
    volumeMounts:
      - mountPath: /var/workdir
        name: workdir
      - name: trusted-ca
        mountPath: /mnt/trusted-ca
        readOnly: true
    env:
      - name: IMAGE_EXPIRES_AFTER
        value: $(params.ociArtifactExpiresAfter)
      - name: "ORAS_OPTIONS"
        value: "$(params.orasOptions)"
      - name: "DEBUG"
        value: "$(params.trustedArtifactsDebug)"
    securityContext:
      runAsUser: 1001
  steps:
    - name: use-trusted-artifact
      computeResources:
        limits:
          memory: 64Mi
        requests:
          memory: 64Mi
          cpu: 30m
      ref:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: stepactions/use-trusted-artifact/use-trusted-artifact.yaml
      params:
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(params.sourceDataArtifact)
    - name: close-issues
      image: quay.io/jbieren/release-service-utils:closeissues_2
      computeResources:
        limits:
          memory: 128Mi
        requests:
          memory: 128Mi
          cpu: 100m
      volumeMounts:
        - name: access-token-secret-vol
          mountPath: "/etc/secrets"
      env:
        - name: PARAM_DATA_DIR
          value: $(params.dataDir)
        - name: PARAM_DATA_PATH
          value: $(params.dataPath)
        - name: PARAM_ADVISORY_URL
          value: $(params.advisoryUrl)
        - name: JIRA_SECRET_PATH
          value: /etc/secrets
      command: ["/home/scripts/python/tasks/managed/close_advisory_issues.py"]
    - name: create-trusted-artifact
      computeResources:
        limits:
          memory: 128Mi
        requests:
          memory: 128Mi
          cpu: 250m
      ref:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: stepactions/create-trusted-artifact/create-trusted-artifact.yaml
      params:
        - name: ociStorage
          value: $(params.ociStorage)
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(results.sourceDataArtifact.path)