check-data-keys.yaml

---
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: check-data-keys
  annotations:
    tekton.dev/pipelines.minVersion: "0.12.1"
    tekton.dev/tags: release
spec:
  description: |-
    Tekton task that validates data keys against a schema to ensure that all required keys for a system(s) are present
    and correctly formatted. The system(s) passed into the `systems` parameter become required.
    The schema validation also applies to all data passed into the `dataPath` parameter,
    meaning all the data keys must be allowed and formatted correctly.

    For example, if `releaseNotes` is passed as a system and the data file does not have all the required
    releaseNotes keys, the schema will give validation errors, and the task will fail.

    The validation schema is bundled in the release-service-utils image at
    `/home/schemas/dataKeys.json`.
  params:
    - name: dataPath
      description: Path to the JSON string of the merged data to use
      type: string
    - name: systems
      description: The systems to check that all data keys are present for
      type: string
      default: ""
    - name: ociStorage
      description: The OCI repository where the Trusted Artifacts are stored
      type: string
      default: "empty"
    - name: ociArtifactExpiresAfter
      description: Expiration date for the trusted artifacts created in the
        OCI repository. An empty string means the artifacts do not expire
      type: string
      default: "1d"
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable
      type: string
      default: ""
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: ""
    - name: sourceDataArtifact
      type: string
      description: Location of trusted artifacts to be used to populate data directory
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
      default: /var/workdir/release
    - name: taskGitUrl
      type: string
      description: The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored
    - name: taskGitRevision
      type: string
      description: The revision in the taskGitUrl repo to be used
    - name: caTrustConfigMapName
      type: string
      description: The name of the ConfigMap to read CA bundle data from
      default: trusted-ca
    - name: caTrustConfigMapKey
      type: string
      description: The name of the key in the ConfigMap that contains the CA bundle data
      default: ca-bundle.crt
    - name: caCertPath
      type: string
      description: Path to CA certificate bundle for TLS verification with self-signed certificates
      default: /mnt/trusted-ca/ca-bundle.crt
  results:
    - description: Produced trusted data artifact
      name: sourceDataArtifact
      type: string
  volumes:
    - name: workdir
      emptyDir: {}
    - name: trusted-ca
      configMap:
        name: $(params.caTrustConfigMapName)
        items:
          - key: $(params.caTrustConfigMapKey)
            path: ca-bundle.crt
        optional: true
  stepTemplate:
    volumeMounts:
      - mountPath: /var/workdir
        name: workdir
      - name: trusted-ca
        mountPath: /mnt/trusted-ca
        readOnly: true
    env:
      - name: IMAGE_EXPIRES_AFTER
        value: $(params.ociArtifactExpiresAfter)
      - name: "ORAS_OPTIONS"
        value: "$(params.orasOptions)"
      - name: "DEBUG"
        value: "$(params.trustedArtifactsDebug)"
    securityContext:
      runAsUser: 1001
  steps:
    - name: use-trusted-artifact
      computeResources:
        limits:
          memory: 64Mi
        requests:
          memory: 64Mi
          cpu: 30m
      ref:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: stepactions/use-trusted-artifact/use-trusted-artifact.yaml
      params:
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(params.sourceDataArtifact)
        - name: caCertPath
          value: $(params.caCertPath)
    - name: check-data-keys
      image: quay.io/konflux-ci/release-service-utils@sha256:282c23415a9995ab3fd6eb79dd314e84aed9b51e96ac3caaa34562c08eb7cc51
      computeResources:
        limits:
          memory: 64Mi
        requests:
          memory: 64Mi  # was exiting with code 137 when set to 32Mi
          cpu: 10m
      env:
        - name: PARAM_DATA_DIR
          value: $(params.dataDir)
        - name: PARAM_DATA_PATH
          value: $(params.dataPath)
        - name: PARAM_SYSTEMS
          value: $(params.systems)
      command: ["/home/scripts/python/tasks/managed/check_data_keys.py"]
    - name: create-trusted-artifact
      computeResources:
        limits:
          memory: 128Mi
        requests:
          memory: 128Mi
          cpu: 250m
      ref:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: stepactions/create-trusted-artifact/create-trusted-artifact.yaml
      params:
        - name: ociStorage
          value: $(params.ociStorage)
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(results.sourceDataArtifact.path)
        - name: caCertPath
          value: $(params.caCertPath)