publish-pyxis-repository.yaml

---
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: publish-pyxis-repository
  annotations:
    tekton.dev/pipelines.minVersion: "0.12.1"
    tekton.dev/tags: release
spec:
  description: |-
    Tekton task to mark all repositories in the mapped snapshot as published in Pyxis.
    This is currently only meant to be used in the rh-push-to-registry-redhat-io
    and rh-advisories pipelines.
    It converts repository URLs to the registry and repository values used in Pyxis:
    - Standard releases: e.g. "quay.io/redhat-prod/my-product----my-image" uses registry
      "registry.access.redhat.com" and repository "my-product/my-image" in Pyxis.
    - Flatpak releases: images pushed to quay.io/rh-flatpaks-prod/* or quay.io/rh-flatpaks-stage/*
      use registry "flatpaks.registry.redhat.io" in Pyxis (for both prod and stage).
    The task also optionally marks repositories as source_container_image_enabled true if
    pushSourceContainer is true in the data JSON.
    Additionally, this task respects the `publish-on-push` flag. If `false`, then the task
    does not publish the repository.

    The task emits a result: `signRegistryAccessPath`

    This contains the relative path in the workspace to a text file that contains a list of
    repositories that need registry.access.redhat.com image references to be signed (i.e.
    requires_terms=true), one repository string per line, e.g. "rhtas/cosign-rhel9".
    Only standard (non-flatpak) repositories are included; flatpak repos are never added.

    Note: This task runs quite early on in the pipeline, because we need the result it produces
    for the signing tasks (and `rh-direct-sign-image` runs quite early to begin with). So this means
    that if you're releasing to a repo for the first time, the repository might get published
    even before the actual image is pushed and published. But we checked with RHEC team and this
    shouldn't cause any problems, because RHEC will ignore repos with no published images.
  params:
    - name: server
      type: string
      description: The server type to use. Options are 'production','production-internal,'stage-internal' and 'stage'
      default: production
    - name: pyxisSecret
      type: string
      description: |
        The kubernetes secret to use to authenticate to Pyxis. It needs to contain two keys: key and cert
    - name: snapshotPath
      description: Path to the JSON file containing the mapped Snapshot spec in the data workspace
      type: string
    - name: dataPath
      description: Path to the JSON string of the merged data to use in the data workspace
      type: string
    - name: resultsDirPath
      description: Path to the results directory in the data workspace
      type: string
    - name: ociStorage
      description: The OCI repository where the Trusted Artifacts are stored
      type: string
      default: "empty"
    - name: ociArtifactExpiresAfter
      description: Expiration date for the trusted artifacts created in the
        OCI repository. An empty string means the artifacts do not expire
      type: string
      default: "1d"
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable
      type: string
      default: ""
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: ""
    - name: sourceDataArtifact
      type: string
      description: Location of trusted artifacts to be used to populate data directory
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
      default: /var/workdir/release
    - name: taskGitUrl
      type: string
      description: The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored
    - name: taskGitRevision
      type: string
      description: The revision in the taskGitUrl repo to be used
    - name: caTrustConfigMapName
      type: string
      description: The name of the ConfigMap to read CA bundle data from
      default: trusted-ca
    - name: caTrustConfigMapKey
      type: string
      description: The name of the key in the ConfigMap that contains the CA bundle data
      default: ca-bundle.crt
  results:
    - name: signRegistryAccessPath
      type: string
      description: |
        The relative path in the workspace to a text file that contains a list of repositories
        that needs registry.access.redhat.com image references to be signed (i.e.
        requires_terms=true), one repository string per line, e.g. "rhtas/cosign-rhel9".
    - description: Produced trusted data artifact
      name: sourceDataArtifact
      type: string
  volumes:
    - name: workdir
      emptyDir: {}
    - name: pyxis-secret-vol
      secret:
        secretName: $(params.pyxisSecret)
        defaultMode: 0444
    - name: trusted-ca
      configMap:
        name: $(params.caTrustConfigMapName)
        items:
          - key: $(params.caTrustConfigMapKey)
            path: ca-bundle.crt
        optional: true

  stepTemplate:
    volumeMounts:
      - mountPath: /var/workdir
        name: workdir
      - name: trusted-ca
        mountPath: /mnt/trusted-ca
        readOnly: true
    env:
      - name: IMAGE_EXPIRES_AFTER
        value: $(params.ociArtifactExpiresAfter)
      - name: "ORAS_OPTIONS"
        value: "$(params.orasOptions)"
      - name: "DEBUG"
        value: "$(params.trustedArtifactsDebug)"
    securityContext:
      runAsUser: 1001
  steps:
    - name: use-trusted-artifact
      computeResources:
        limits:
          memory: 64Mi
        requests:
          memory: 64Mi
          cpu: 30m
      ref:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: stepactions/use-trusted-artifact/use-trusted-artifact.yaml
      params:
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(params.sourceDataArtifact)
    - name: publish-pyxis-repository
      image: quay.io/konflux-ci/release-service-utils@sha256:0500c0e70b08ee3371ceac717d78436cfcb621ca1545b0f91081db19f223cd6f
      computeResources:
        limits:
          memory: 128Mi
        requests:
          memory: 128Mi
          cpu: 450m
      volumeMounts:
        - name: pyxis-secret-vol
          mountPath: "/etc/secrets"
      env:
        - name: PYXIS_SECRET_MOUNT
          value: /etc/secrets
        - name: PARAM_DATA_DIR
          value: $(params.dataDir)
        - name: PARAM_SNAPSHOT_PATH
          value: $(params.snapshotPath)
        - name: PARAM_DATA_PATH
          value: $(params.dataPath)
        - name: PARAM_RESULTS_DIR_PATH
          value: $(params.resultsDirPath)
        - name: PARAM_SERVER
          value: $(params.server)
        - name: RESULT_SIGN_REGISTRY_ACCESS_PATH
          value: $(results.signRegistryAccessPath.path)
        - name: TASK_NAME
          value: $(context.task.name)
      command: ["/home/scripts/python/tasks/managed/publish_pyxis_repository.py"]
    - name: create-trusted-artifact
      computeResources:
        limits:
          memory: 128Mi
        requests:
          memory: 128Mi
          cpu: 250m
      ref:
        resolver: "git"
        params:
          - name: url
            value: "$(params.taskGitUrl)"
          - name: revision
            value: "$(params.taskGitRevision)"
          - name: pathInRepo
            value: stepactions/create-trusted-artifact/create-trusted-artifact.yaml
      params:
        - name: ociStorage
          value: $(params.ociStorage)
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(results.sourceDataArtifact.path)