create-advisory.yaml

---
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: create-advisory
  annotations:
    tekton.dev/pipelines.minVersion: "0.12.1"
    tekton.dev/tags: release
spec:
  description: |-
    Tekton task to create an advisory via an InternalRequest. The advisory data is pulled from the data JSON. The origin
    workspace from the ReleasePlanAdmission and Application from the Snapshot are also used. The advisory is created in
    a GitLab repository. Which repository to use is determined by the contents on the mapped repositories.
    Only all `redhat-pending` or all `redhat-prod` repositories may be specified in `.data.mapping`
  params:
    - name: jsonKey
      type: string
      description: The json key containing the advisory data
      default: ".releaseNotes"
    - name: releasePlanAdmissionPath
      type: string
      description: Path to the JSON string of the ReleasePlanAdmission in the data workspace
    - name: snapshotPath
      type: string
      description: Path to the JSON string of the Snapshot spec in the data workspace
    - name: dataPath
      type: string
      description: Path to the data JSON in the data workspace
    - name: environment
      type: string
      description: The environment for the advisory to be published. Options are stage and production
      default: ""
    - name: resultsDirPath
      type: string
      description: Path to the results directory in the data workspace
    - name: request
      type: string
      description: Type of request to be created
      default: "create-advisory"
    - name: synchronously
      type: string
      description: Whether the task should wait for InternalRequests to complete
      default: "true"
    - name: pipelineRunUid
      type: string
      description: The uid of the current pipelineRun. Used as a label value when creating internal requests
    - name: ociStorage
      description: The OCI repository where the Trusted Artifacts are stored
      type: string
      default: "empty"
    - name: ociArtifactExpiresAfter
      description: Expiration date for the trusted artifacts created in the
        OCI repository. An empty string means the artifacts do not expire
      type: string
      default: "1d"
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable
      type: string
      default: ""
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: ""
    - name: sourceDataArtifact
      type: string
      description: Location of trusted artifacts to be used to populate data directory
      default: ""
    - name: checksum_map
      type: string
      description: >
        OCI artifact reference for checksum map from internal push-artifacts-to-cdn
        (or raw JSON for backwards compatibility)
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
      default: /var/workdir/release
    - name: taskGitUrl
      type: string
      description: The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored
    - name: taskGitRevision
      type: string
      description: The revision in the taskGitUrl repo to be used
    - name: caTrustConfigMapName
      type: string
      description: The name of the ConfigMap to read CA bundle data from
      default: trusted-ca
    - name: caTrustConfigMapKey
      type: string
      description: The name of the key in the ConfigMap that contains the CA bundle data
      default: ca-bundle.crt
    - name: trustedArtifactsDockerConfigSecret
      type: string
      description: The name of the secret containing dockerconfig for pulling OCI artifacts
      default: quay-token-konflux-release-trusted-artifacts-secret
  results:
    - name: advisory_url
      type: string
      description: The advisory url if one was created
    - name: advisory_internal_url
      type: string
      description: The advisory internal url if one was created
    - description: Produced trusted data artifact
      name: sourceDataArtifact
      type: string
  volumes:
    - name: workdir
      emptyDir: {}
    - name: trusted-ca
      configMap:
        name: $(params.caTrustConfigMapName)
        items:
          - key: $(params.caTrustConfigMapKey)
            path: ca-bundle.crt
        optional: true
    - name: trusted-artifacts-dockerconfig-secret
      secret:
        optional: true
        secretName: $(params.trustedArtifactsDockerConfigSecret)
        defaultMode: 0444
  stepTemplate:
    volumeMounts:
      - mountPath: /var/workdir
        name: workdir
      - name: trusted-ca
        mountPath: /mnt/trusted-ca
        readOnly: true
    env:
      - name: IMAGE_EXPIRES_AFTER
        value: $(params.ociArtifactExpiresAfter)
      - name: "ORAS_OPTIONS"
        value: "$(params.orasOptions)"
      - name: "DEBUG"
        value: "$(params.trustedArtifactsDebug)"
    securityContext:
      runAsUser: 1001
  steps:
    - name: use-trusted-artifact
      computeResources:
        limits:
          memory: 64Mi
        requests:
          memory: 64Mi
          cpu: 30m
      ref:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: stepactions/use-trusted-artifact/use-trusted-artifact.yaml
      params:
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(params.sourceDataArtifact)
    - name: update-purl
      image: quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3
      computeResources:
        limits:
          memory: 256Mi
        requests:
          memory: 256Mi
          cpu: 100m
      volumeMounts:
        - name: trusted-artifacts-dockerconfig-secret
          mountPath: /mnt/trusted_artifacts_dockerconfig
      env:
        - name: HOME
          value: /tekton/home
      script: |
        #!/bin/bash
        set -exo pipefail

        # This step uses the checksum_map (generated by the internal push-artifacts-to-cdn task)
        # to populate PURL fields with checksums for generic/binary/disk-image artifacts.
        # This step is skipped for rpm and container image releases.

        DATA_FILE="$(params.dataDir)/$(params.dataPath)"

        # Skip update-purl for marketplace releases (they generate purls in populate-release-notes)
        if [[ -n "$(jq -r '.mapping.cloudMarketplacesSecret // empty' "$DATA_FILE")" ]]; then
          echo "Marketplace release detected. Skipping PURL updates."
          exit 0
        fi

        # Try to extract the first contentType if it exists
        content_type=$(jq -r '.mapping.components[]? |
          (.contentGateway?.contentType // .contentType) // empty' "$DATA_FILE" | head -n1)

        # If no contentType is found, check if this is a github release
        if [ -z "$content_type" ]; then
          github_field=$(jq -r '.github // empty' "$DATA_FILE")
          if [[ -n "$github_field" ]]; then
            echo "Github release. Skipping update-purl."
            exit 0
          fi
          echo "Content type is not a generic artifact, skipping update-purl"
          exit 0
        fi

        # Only binary/generic/disk-image need PURL updates with checksums
        if [[ ! "$content_type" =~ ^(binary|generic|disk-image)$ ]]; then
          echo "Content type '$content_type'. Skipping update-purl."
          exit 0
        fi

        echo "Processing $content_type artifacts for PURL updates..."

        # If all artifacts already have real (non-placeholder) PURLs, skip update-purl entirely.
        # This handles content types (e.g. Python wheels) where PURLs are populated upstream
        # and no checksum_map is needed.
        ARTIFACT_COUNT=$(jq '$(params.jsonKey).content.artifacts // [] | length' "$DATA_FILE")
        POPULATED_COUNT=$(jq '$(params.jsonKey).content.artifacts // []
          | map(select(.purl != null and .purl != "" and .purl != "placeholder")) | length' "$DATA_FILE")
        if [[ "$ARTIFACT_COUNT" -gt 0 && "$ARTIFACT_COUNT" -eq "$POPULATED_COUNT" ]]; then
          echo "All $ARTIFACT_COUNT artifacts already have PURLs populated. Skipping update-purl."
          exit 0
        fi

        # Determine environment and set base URLs accordingly
        CDN_ENV=$(jq -r '.cdn.env // "production"' "$DATA_FILE")
        if [ "$CDN_ENV" = "stage" ] || [ "$CDN_ENV" = "qa" ]; then
          CGW_BASE_URL="https://developers.qa.redhat.com/products"
          CDN_BASE_URL="https://access.stage.redhat.com/downloads"
        else
          CGW_BASE_URL="https://developers.redhat.com/products"
          CDN_BASE_URL="https://access.redhat.com/downloads"
        fi
        echo "Using $CDN_ENV environment: CGW=$CGW_BASE_URL, CDN=$CDN_BASE_URL"

        # Setup docker config for OCI pull (same pattern as internal tasks)
        TA_DOCKERCONFIG_JSON_PATH="/mnt/trusted_artifacts_dockerconfig/.dockerconfigjson"
        if [ -f "${TA_DOCKERCONFIG_JSON_PATH}" ] && [ -s "${TA_DOCKERCONFIG_JSON_PATH}" ]; then
          mkdir -p ~/.docker/
          cp "${TA_DOCKERCONFIG_JSON_PATH}" ~/.docker/config.json
          echo "Docker config loaded for OCI pull"
        fi

        CHECKSUM_MAP_PARAM="$(params.checksum_map)"
        CHECKSUM_MAP_JSON=""

        if [ -z "$CHECKSUM_MAP_PARAM" ] || [ "$CHECKSUM_MAP_PARAM" = "null" ] \
            || [ "$CHECKSUM_MAP_PARAM" = "empty" ]; then
          echo "Error: checksum map is required for content type '$content_type' but was not provided."
          exit 1
        fi

        # Pull checksum_map from OCI (pushed by internal push-artifacts-to-cdn task)
        echo "Pulling checksum_map from OCI: $CHECKSUM_MAP_PARAM"
        PULL_DIR=$(mktemp -d)
        pushd "$PULL_DIR" > /dev/null
        
        if ! oras pull "$CHECKSUM_MAP_PARAM"; then
          echo "Error: Failed to pull checksum_map from OCI: $CHECKSUM_MAP_PARAM"
          exit 1
        fi
        
        # Extract the tar archive if present
        if [ -f "checksum_map" ]; then
          tar -xzf checksum_map
        fi
        
        if [ -f "checksum_map.json" ]; then
          CHECKSUM_MAP_JSON=$(cat checksum_map.json)
        else
          echo "Error: checksum_map.json not found in OCI artifact"
          exit 1
        fi
        
        popd > /dev/null
        rm -rf "$PULL_DIR"

        # Validate the JSON
        json_len=$(jq 'length' <<< "$CHECKSUM_MAP_JSON" 2>/dev/null || echo 0)
        if [ -z "$CHECKSUM_MAP_JSON" ] || [ "$json_len" -eq 0 ]; then
          echo "Error: checksum map is empty or invalid JSON"
          exit 1
        fi
        echo "Checksum manifest loaded with $json_len component(s)."

        COMPONENTS=$(jq -c '.mapping.components[]' "$DATA_FILE")

        # Build a name → staged.files lookup from the snapshot.  apply-mapping substitutes
        # {{ release_timestamp }} (and other template vars) in the snapshot's components but
        # does NOT write those substitutions back to the data file.  Reading staged.files from
        # DATA_FILE would produce filenames like "foo-{{ release_timestamp }}-x86_64.iso" which
        # Jinja2 would then render as empty, giving "foo--x86_64.iso" in the advisory.
        SNAPSHOT_FILE="$(params.dataDir)/$(params.snapshotPath)"
        SNAPSHOT_STAGED=$(jq -c \
          'reduce .components[] as $c ({}; .[$c.name] = ($c.staged.files // []))' \
          "$SNAPSHOT_FILE")

        UPDATED_ENTRIES=()

        while IFS= read -r component; do
            COMPONENT_NAME=$(jq -r '.name' <<< "$component")
            # Use contentGateway.productVersionName if present, otherwise fall back to staged.version
            VERSION_NAME=$(jq -r \
              '.contentGateway.productVersionName // .staged.version // empty' <<< "$component")
            
            if [ -z "$VERSION_NAME" ] || [ "$VERSION_NAME" = "null" ]; then
              echo "Warning: No version found for component $COMPONENT_NAME" >&2
              echo "  (checked .contentGateway.productVersionName and .staged.version)" >&2
              continue
            fi

            # Get all advisory entries that match this component
            MATCHING_ENTRIES=$(jq -c --arg name "$COMPONENT_NAME" \
              '.releaseNotes.content.artifacts[] | select(.component == $name)' "$DATA_FILE")

            if [ -z "$MATCHING_ENTRIES" ]; then
              echo "Warning: no releaseNotes.content.artifacts entries found for component: $COMPONENT_NAME" >&2
              continue
            fi

            if [ "$content_type" = "disk-image" ]; then
              # For disk-images, generate one advisory entry per file in staged.files[].
              # Multiple files can share the same os+arch (e.g. ISO + QCOW2 both linux/amd64),
              # so iterating over advisory entries (one per os+arch) would produce malformed PURLs.
              # Instead, use the first advisory entry as a metadata template and expand it per file.
              TEMPLATE_ENTRY=$(echo "$MATCHING_ENTRIES" | head -1)
              # When a component has both contentGateway (Developer Portal) and staged (Customer
              # Portal/CDN), CGW is used as the canonical download_url in the PURL. If only
              # staged is present, the CDN URL is used instead.
              HAS_CGW=$(jq -r 'if ((.contentGateway // {}) | length) > 0 then "true" else "false" end' \
                <<< "$component")
              if [ "$HAS_CGW" = "true" ]; then
                DOWNLOAD_URL="$CGW_BASE_URL"
              else
                DOWNLOAD_URL="$CDN_BASE_URL"
              fi

              while IFS= read -r staged_file; do
                FILENAME=$(jq -r '.filename' <<< "$staged_file")
                FILENAME_BASENAME=$(basename "$FILENAME")

                # Derive arch from filename (same logic as populate-release-notes)
                FILE_ARCH="unknown"
                if [[ "$FILENAME_BASENAME" == *"aarch64"* ]]; then
                  FILE_ARCH="aarch64"
                elif [[ "$FILENAME_BASENAME" == *"x86_64"* ]]; then
                  FILE_ARCH="x86_64"
                fi
                FILE_OS="linux"  # Default for disk images

                CHECKSUM=$(jq -r --arg component "$COMPONENT_NAME" --arg filename "$FILENAME_BASENAME" \
                  '.[] | select(.component == $component) | .files[$filename] // empty' \
                  <<< "$CHECKSUM_MAP_JSON")
                if [ -z "$CHECKSUM" ]; then
                  echo "Warning: No checksum found for $COMPONENT_NAME/$FILENAME_BASENAME in manifest" >&2
                fi

                PURL="pkg:generic/$COMPONENT_NAME@$VERSION_NAME"
                QUERY_PARAMS=()
                # Add filename first - this uniquely identifies the file
                if [ -n "$FILENAME_BASENAME" ]; then
                  QUERY_PARAMS+=("filename=$FILENAME_BASENAME")
                fi
                if [ -n "$CHECKSUM" ]; then
                  QUERY_PARAMS+=("checksum=$CHECKSUM")
                fi
                if [ -n "$DOWNLOAD_URL" ]; then
                  QUERY_PARAMS+=("download_url=$DOWNLOAD_URL")
                fi
                if [ "${#QUERY_PARAMS[@]}" -gt 0 ]; then
                  PURL="${PURL}?$(IFS=\&; echo "${QUERY_PARAMS[*]}")"
                fi

                UPDATED_ENTRY=$(jq -c \
                  --arg purl "$PURL" --arg arch "$FILE_ARCH" --arg os "$FILE_OS" \
                  '.purl = $purl | .architecture = $arch | .os = $os' <<< "$TEMPLATE_ENTRY")
                UPDATED_ENTRIES+=("$UPDATED_ENTRY")
              done <<< "$(jq -c --arg name "$COMPONENT_NAME" '.[$name][]?' <<< "$SNAPSHOT_STAGED")"
            else
              while IFS= read -r entry; do
                ARCH=$(jq -r '.architecture' <<< "$entry")
                OS=$(jq -r '.os' <<< "$entry")

                # Binary/generic files have arch/os matching, falling back to staged.files
                # for teams that use the CDN staged structure instead of a top-level files array
                FILENAME=$(jq -r --arg arch "$ARCH" --arg os "$OS" \
                  '((.files // []) as $f
                     | if ($f|length) > 0 then $f else (.staged.files // []) end)[]
                     | select(.arch == $arch and .os == $os) | .source' \
                  <<< "$component")

                FILENAME_BASENAME=$(basename "$FILENAME")
                # Apply Windows archive conversion (.tar.gz -> .zip) when looking up checksum
                # This matches the conversion done in compress-artifacts step of push-artifacts-to-cdn-task
                if [ "$OS" = "windows" ] && [[ "$FILENAME_BASENAME" == *.tar.gz ]]; then
                  FILENAME_BASENAME="${FILENAME_BASENAME%.tar.gz}.zip"
                fi

                CHECKSUM=$(jq -r --arg component "$COMPONENT_NAME" --arg filename "$FILENAME_BASENAME" \
                  '.[] | select(.component == $component) | .files[$filename] // empty' \
                  <<< "$CHECKSUM_MAP_JSON")
                if [ -z "$CHECKSUM" ]; then
                  echo "Warning: No checksum found for $COMPONENT_NAME/$FILENAME_BASENAME in manifest" >&2
                fi

                # When a component has both contentGateway (Developer Portal) and staged (Customer
                # Portal/CDN), CGW is used as the canonical download_url in the PURL. If only
                # staged is present, the CDN URL is used instead.
                HAS_CGW=$(jq -r 'if ((.contentGateway // {}) | length) > 0 then "true" else "false" end' \
                  <<< "$component")
                if [ "$HAS_CGW" = "true" ]; then
                  DOWNLOAD_URL="$CGW_BASE_URL"
                else
                  DOWNLOAD_URL="$CDN_BASE_URL"
                fi

                PURL="pkg:generic/$COMPONENT_NAME@$VERSION_NAME"
                QUERY_PARAMS=()
                # Add filename first - this uniquely identifies the file and is used for idempotency matching
                if [ -n "$FILENAME_BASENAME" ]; then
                  QUERY_PARAMS+=("filename=$FILENAME_BASENAME")
                fi
                if [ -n "$CHECKSUM" ]; then
                  QUERY_PARAMS+=("checksum=$CHECKSUM")
                fi
                if [ -n "$DOWNLOAD_URL" ]; then
                  QUERY_PARAMS+=("download_url=$DOWNLOAD_URL")
                fi
                if [ "${#QUERY_PARAMS[@]}" -gt 0 ]; then
                  PURL="${PURL}?$(IFS=\&; echo "${QUERY_PARAMS[*]}")"
                fi

                UPDATED_ENTRY=$(jq -c --arg purl "$PURL" '.purl = $purl' <<< "$entry")
                UPDATED_ENTRIES+=("$UPDATED_ENTRY")
              done <<< "$MATCHING_ENTRIES"
            fi

        done <<< "$COMPONENTS"

        if [ "${#UPDATED_ENTRIES[@]}" -eq 0 ]; then
          echo "No advisory entries were updated."
          exit 0
        fi

        ENTRIES_JOINED=$(IFS=,; echo "${UPDATED_ENTRIES[*]}")
        if [ "$content_type" = "disk-image" ]; then
          # For disk-images, drop all existing advisory entries for the updated components and
          # replace them with the new per-file entries. We cannot deduplicate by component|arch|os
          # because multiple files (e.g. ISO + QCOW2) legitimately share the same arch/os.
          jq --argjson updated "[$ENTRIES_JOINED]" '
            ($updated | map(.component) | unique) as $updated_components |
            .releaseNotes.content.artifacts |= (
              map(select(.component | IN($updated_components[]) | not)) + $updated
            )
          ' "$DATA_FILE" > /tmp/data.tmp && mv /tmp/data.tmp "$DATA_FILE"
        else
          # Merge updated advisory entries back into releaseNotes.content.artifacts in the DATA_FILE.
          # Deduplicate by component|architecture|os to handle cases where multiple files share the
          # same arch/os (e.g. binary + ISO for same arch).
          UPDATED_MAP=$(jq -nc --argjson updated "[$ENTRIES_JOINED]" '
            reduce $updated[] as $item ({}; . + {($item.component + "|" + $item.architecture + "|" + $item.os): $item})
          ')
          jq --argjson updated "$UPDATED_MAP" '
            .releaseNotes.content.artifacts |= (
              map(($updated[(.component + "|" + .architecture + "|" + .os)] // .))
              | reduce .[] as $item ({}; . + {($item.component + "|" + $item.architecture + "|" + $item.os): $item})
              | [.[]]
            )
          ' "$DATA_FILE" > /tmp/data.tmp && mv /tmp/data.tmp "$DATA_FILE"
        fi
    - name: run-script
      image: quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3
      computeResources:
        limits:
          memory: 512Mi
        requests:
          memory: 512Mi
          cpu: 650m
      script: |
        #!/bin/bash
        set -ex

        DEFAULT_ADVISORY_TYPE="RHBA"
        RESULTS_FILE="$(params.dataDir)/$(params.resultsDirPath)/create-advisory-results.json"

        # Obtain componentGroup from snapshot
        componentGroup=$(jq -r .componentGroup "$(params.dataDir)/$(params.snapshotPath)")

        # Obtain origin workspace from releasePlanAdmission
        origin=$(jq -r '.spec.origin' "$(params.dataDir)/$(params.releasePlanAdmissionPath)")

        # Extract the advisory key and signing configMap name from the data JSON file
        advisoryData=$(jq -c "$(params.jsonKey)" "$(params.dataDir)/$(params.dataPath)")
        configMapName=$(jq -er '.sign.configMapName' "$(params.dataDir)/$(params.dataPath)")

        # Check custom advisory live id
        advisoryLiveId=$(jq -r '.live_id' <<< "$advisoryData")
        advisoryAllowCustomLiveId=$(jq -r '.allow_custom_live_id // false' <<< "$advisoryData")
        if [ "$advisoryAllowCustomLiveId" != true ] && [ "$advisoryLiveId" != "null" ]; then
          echo "Error: advisory live id is only allowed if allow_custom_live_id is set to true"
          exit 1
        fi

        # Validate type
        advisoryType=$(jq -r '.type' <<< "$advisoryData")
        if [ "$advisoryType" == "null" ]; then
          # default to $DEFAULT_ADVISORY_TYPE
          echo "Defaulting to type = $DEFAULT_ADVISORY_TYPE"
          advisoryData=$(jq -c --arg DEFAULT_ADVISORY_TYPE "$DEFAULT_ADVISORY_TYPE" \
            '.type = $DEFAULT_ADVISORY_TYPE' <<< "$advisoryData")
          advisoryType="$DEFAULT_ADVISORY_TYPE"
        fi

        DATA_FILE="$(params.dataDir)/$(params.dataPath)"

        # Try to extract the first contentType if it exists
        content_type=$(jq -r '.mapping.components[]? |
          (.contentGateway?.contentType // .contentType) // empty' "$DATA_FILE" | head -n1)

        # if no content type, check if this is a github release by looking for .github in data.json
        if [ -z "$content_type" ]; then
          github_field=$(jq -r '.github // empty' "$DATA_FILE")
          if [[ -n "$github_field" ]]; then
            content_type="generic"
          else
            content_type="image"
          fi
        fi

        if [[ "$content_type" =~ ^(binary|generic|disk-image|rpm)$ ]] ; then
          content_path=".content.artifacts"
        else
          content_path=".content.images"
        fi

        if ! [[ "$advisoryType" =~ ^(RHSA|RHBA|RHEA)$ ]]; then
            echo "Error: advisory type must be one of RHSA, RHBA or RHEA"
            exit 1
        fi

        # Ensure RHSA is only used if CVEs are provided

        NUM_CVES=$(jq "[${content_path}[]?.cves.fixed // [] | length] | add" <<< "$advisoryData")

        if [[ "$advisoryType" == "RHSA" ]] && [[ "$NUM_CVES" -eq 0 ]] ; then
            echo "Provided advisory type is RHSA, but no fixed CVEs were listed"
            echo "RHSA should only be used if CVEs are fixed in the advisory. Failing..."
            exit 1
        fi

        pipelinerun_label="internal-services.appstudio.openshift.io/pipelinerun-uid"

        # only 2 gitlab instances are permitted...prod and staging
        # these are their secret names
        #

        prodSecretName="create-advisory-prod-secret"
        prodErrataSecretName="errata-prod-service-account"
        stagingSecretName="create-advisory-stage-secret"
        stagingErrataSecretName="errata-stage-service-account"

        # All content types use the standard prod/stage advisory repos.
        # This conditional remains because env selection differs by content type:
        # - image/rpm: derive env from params.environment
        # - other types: derive env from data.json .intention
        if [[ "$content_type" =~ ^(image|rpm)$ ]] ; then

          advisorySecretName="${prodSecretName}"
          errataSecretName="${prodErrataSecretName}"
          # We allow "stage" or "staging" for the environment parameter
          if [[ "$(params.environment)" =~ ^(stage|staging)$ ]]; then
            advisorySecretName="${stagingSecretName}"
            errataSecretName="${stagingErrataSecretName}"
          fi
        else
          # Keep explicit assignments here for readability in this branch.
          prodSecretName="create-advisory-prod-secret"
          prodErrataSecretName="errata-prod-service-account"
          stagingSecretName="create-advisory-stage-secret"
          stagingErrataSecretName="errata-stage-service-account"

          DATA_FILE="$(params.dataDir)/$(params.dataPath)"
          INTENTION=$(jq -r '.intention' "$DATA_FILE")

          if [[ "$INTENTION" == "production" ]]; then
            advisorySecretName="$prodSecretName"
            errataSecretName="$prodErrataSecretName"
          elif [[ "$INTENTION" == "staging" ]]; then
            advisorySecretName="$stagingSecretName"
            errataSecretName="$stagingErrataSecretName"
          fi
        fi

        IR_FILE="$(params.dataDir)/$(context.task.name)/ir-result.txt"
        mkdir -p "$(dirname "$IR_FILE")"

        advisoryDataCompressed=$(gzip <<< "${advisoryData}" | base64 -w0)
        echo "Creating InternalRequest to create advisory..."
        internal-request --pipeline "$(params.request)" \
                         -p componentGroup="${componentGroup}" \
                         -p origin="${origin}" \
                         -p advisory_json="${advisoryDataCompressed}" \
                         -p config_map_name="${configMapName}" \
                         -p contentType="${content_type}" \
                         -p advisory_secret_name="${advisorySecretName}" \
                         -p errata_secret_name="${errataSecretName}" \
                         -p taskGitUrl="$(params.taskGitUrl)" \
                         -p taskGitRevision="$(params.taskGitRevision)" \
                         -s "$(params.synchronously)" \
                         --pipeline-timeout "01h05m00s" \
                         --task-timeout "01h00m00s" \
                         -l ${pipelinerun_label}="$(params.pipelineRunUid)" \
                         | tee "$IR_FILE" || \
                         (grep "^\[" "$IR_FILE" | jq . && exit 1)

        internalRequest=$(awk -F"'" '/created/ { print $2 }' "$IR_FILE")
        echo "done (${internalRequest})"

        echo -n "" > "$(results.advisory_url.path)"
        results=$(kubectl get internalrequest "$internalRequest" -o=jsonpath='{.status.results}')
        internalRequestPipelineRunName="$(jq -jr '.internalRequestPipelineRunName // ""' <<< "${results}")"
        internalRequestTaskRunName="$(jq -jr '.internalRequestTaskRunName // ""' <<< "${results}")"

        echo "** internalRequestPipelineRunName: ${internalRequestPipelineRunName}"
        echo "** internalRequestTaskRunName: ${internalRequestTaskRunName}"

        if [[ "$(echo "${results}" | jq -r '.result')" == "Success" ]]; then
          echo "Advisory created"
        else
          echo "Advisory creation failed"
          echo "$results"
          exit 1
        fi

        URL=$(echo "${results}" | jq -r '.advisory_url // ""')
        echo -n "$URL" | tee "$(results.advisory_url.path)"
        INTERNAL_URL=$(echo "${results}" | jq -r '.advisory_internal_url // ""')
        echo -n "$INTERNAL_URL" | tee "$(results.advisory_internal_url.path)"
        jq -n --arg url "$URL" --arg internal_url "$INTERNAL_URL" \
          '{"advisory": {"url": $url, "internal_url": $internal_url}}' | tee "$RESULTS_FILE"
    - name: create-trusted-artifact
      computeResources:
        limits:
          memory: 128Mi
        requests:
          memory: 128Mi
          cpu: 250m
      ref:
        resolver: "git"
        params:
          - name: url
            value: "$(params.taskGitUrl)"
          - name: revision
            value: "$(params.taskGitRevision)"
          - name: pathInRepo
            value: stepactions/create-trusted-artifact/create-trusted-artifact.yaml
      params:
        - name: ociStorage
          value: $(params.ociStorage)
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(results.sourceDataArtifact.path)