test-create-advisory-disk-image-secrets.yaml

---
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: test-create-advisory-disk-image-secrets
spec:
  description: |
    Verify that for disk-image content types the task uses staging secrets when
    intention is 'staging'.
  params:
    - name: ociStorage
      description: The OCI repository where the Trusted Artifacts are stored.
      type: string
    - name: ociArtifactExpiresAfter
      description: Expiration date for the trusted artifacts created in the
        OCI repository. An empty string means the artifacts do not expire.
      type: string
      default: "1d"
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: "--insecure"
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable.
      type: string
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
  tasks:
    - name: setup
      taskSpec:
        results:
          - name: sourceDataArtifact
            type: string
          - name: checksum_map
            type: string
        volumes:
          - name: workdir
            emptyDir: {}
        stepTemplate:
          volumeMounts:
            - mountPath: /var/workdir
              name: workdir
          env:
            - name: IMAGE_EXPIRES_AFTER
              value: $(params.ociArtifactExpiresAfter)
            - name: "ORAS_OPTIONS"
              value: "$(params.orasOptions)"
            - name: "DEBUG"
              value: "$(params.trustedArtifactsDebug)"
          securityContext:
            runAsUser: 1001
        steps:
          - name: create-crs
            image: quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3
            script: |
              #!/usr/bin/env bash
              set -eux

              mkdir -p "$(params.dataDir)/$(context.pipelineRun.uid)/results"

              cat > "$(params.dataDir)/$(context.pipelineRun.uid)/test_release_plan_admission.json" << 'EOF'
              {
                "apiVersion": "appstudio.redhat.com/v1alpha1",
                "kind": "ReleasePlanAdmission",
                "metadata": {
                  "name": "test",
                  "namespace": "default"
                },
                "spec": {
                  "applications": ["rhel-ai-app"],
                  "policy": "policy",
                  "pipeline": {
                    "pipelineRef": {
                      "resolver": "git",
                      "params": [
                        {
                          "name": "url",
                          "value": "github.com"
                        },
                        {
                          "name": "revision",
                          "value": "main"
                        },
                        {
                          "name": "pathInRepo",
                          "value": "pipeline.yaml"
                        }
                      ]
                    }
                  },
                  "serviceAccountName": "sa"
                },
                "origin": "rhel-ai-tenant"
              }
              EOF

              cat > "$(params.dataDir)/$(context.pipelineRun.uid)/test_snapshot_spec.json" << 'EOF'
              {
                "application": "rhel-ai-app",
                "components": [
                  {
                    "name": "intel-bootc-iso-disk-image-1-5",
                    "repository": "quay.io/redhat-prod/rhel-ai----disk-image",
                    "staged": {
                      "files": [
                        {
                          "filename": "rhel-ai-intel-1.5.1-1749643937-x86_64.iso.gz",
                          "source": "install.iso.gz"
                        }
                      ]
                    }
                  }
                ]
              }
              EOF

              cat > "$(params.dataDir)/$(context.pipelineRun.uid)/data.json" << 'EOF'
              {
                "mapping": {
                  "components": [
                    {
                      "name": "intel-bootc-iso-disk-image-1-5",
                      "staged": {
                        "destination": "rhelai-1_DOT_5-for-rhel-9-x86_64-isos",
                        "version": "1.5.1",
                        "files": [
                          {
                            "filename": "rhel-ai-intel-1.5.1-1749643937-x86_64.iso.gz",
                            "source": "install.iso.gz"
                          }
                        ]
                      },
                      "contentGateway": {
                        "contentType": "disk-image",
                        "productName": "Binary_RL_Red Hat Enterprise Linux AI",
                        "productCode": "RHELAI",
                        "productVersionName": "1.5.1",
                        "filePrefix": "rhel-ai-intel-1.5.1"
                      }
                    }
                  ]
                },
                "releaseNotes": {
                  "content": {
                    "artifacts": [
                      {
                        "architecture": "x86_64",
                        "component": "intel-bootc-iso-disk-image-1-5",
                        "os": "linux",
                        "purl": "placeholder"
                      }
                    ]
                  }
                },
                "sign": {
                  "configMapName": "cm"
                },
                "intention": "staging"
              }
              EOF

              # Create checksum_map mock data file (will be read by oras mock)
              jq -nc '[
                {
                  "component": "intel-bootc-iso-disk-image-1-5",
                  "files": {
                    "rhel-ai-intel-1.5.1-1749643937-x86_64.iso.gz": "sha256:dummychecksum123456"
                  }
                }
              ]' > "$(params.dataDir)/mock_checksum_map.json"
              # Output mock OCI reference (oras mock will use the file above)
              echo -n "mock-registry/checksum-map@sha256:mock" | tee "$(results.checksum_map.path)"
          - name: create-trusted-artifact
            ref:
              name: create-trusted-artifact
            params:
              - name: ociStorage
                value: $(params.ociStorage)
              - name: workDir
                value: $(params.dataDir)
              - name: sourceDataArtifact
                value: $(results.sourceDataArtifact.path)
    - name: run-task
      taskRef:
        name: create-advisory
      params:
        - name: releasePlanAdmissionPath
          value: "$(context.pipelineRun.uid)/test_release_plan_admission.json"
        - name: snapshotPath
          value: "$(context.pipelineRun.uid)/test_snapshot_spec.json"
        - name: dataPath
          value: "$(context.pipelineRun.uid)/data.json"
        - name: environment
          value: stage
        - name: resultsDirPath
          value: "$(context.pipelineRun.uid)/results"
        - name: synchronously
          value: "false"
        - name: pipelineRunUid
          value: $(context.pipelineRun.uid)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: orasOptions
          value: $(params.orasOptions)
        - name: sourceDataArtifact
          value: "$(tasks.setup.results.sourceDataArtifact)=$(params.dataDir)/$(context.pipelineRun.uid)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: $(params.trustedArtifactsDebug)
        - name: taskGitUrl
          value: "http://localhost"
        - name: taskGitRevision
          value: "main"
        - name: checksum_map
          value: "$(tasks.setup.results.checksum_map)"
      runAfter:
        - setup
    - name: check-result
      params:
        - name: sourceDataArtifact
          value: "$(tasks.run-task.results.sourceDataArtifact)=$(params.dataDir)"
        - name: dataDir
          value: "$(params.dataDir)"
      runAfter:
        - run-task
      taskSpec:
        params:
          - name: sourceDataArtifact
            type: string
          - name: dataDir
            type: string
        volumes:
          - name: workdir
            emptyDir: {}
        stepTemplate:
          volumeMounts:
            - mountPath: /var/workdir
              name: workdir
          env:
            - name: IMAGE_EXPIRES_AFTER
              value: $(params.ociArtifactExpiresAfter)
            - name: "ORAS_OPTIONS"
              value: "$(params.orasOptions)"
            - name: "DEBUG"
              value: "$(params.trustedArtifactsDebug)"
          securityContext:
            runAsUser: 1001
        steps:
          - name: use-trusted-artifact
            ref:
              name: use-trusted-artifact
            params:
              - name: workDir
                value: $(params.dataDir)
              - name: sourceDataArtifact
                value: $(params.sourceDataArtifact)
          - name: check-result
            image: quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3
            script: |
              #!/usr/bin/env bash
              set -ex

              # Count the number of InternalRequests
              requestsCount=$(kubectl get InternalRequest -o json | jq -r '.items | length')

              if [ "$requestsCount" -ne 1 ]; then
                echo "Unexpected number of InternalRequests. Expected: 1, Found: $requestsCount"
                exit 1
              fi

              internalRequest=$(kubectl get InternalRequest -o json | jq -r '.items[0]')

              # For disk-image content types with intention=staging, expect standard staging secrets
              advisory_secret_name=$(echo "$internalRequest" | jq -r '.spec.params.advisory_secret_name')
              if [ "$advisory_secret_name" != "create-advisory-stage-secret" ]; then
                echo "InternalRequest has the wrong advisory_secret_name parameter"
                echo "$internalRequest" | jq
                exit 1
              fi

              errata_secret_name=$(echo "$internalRequest" | jq -r '.spec.params.errata_secret_name')
              if [ "$errata_secret_name" != "errata-stage-service-account" ]; then
                echo "InternalRequest has the wrong errata_secret_name parameter"
                echo "$internalRequest" | jq
                exit 1
              fi

  finally:
    - name: cleanup
      taskSpec:
        steps:
          - name: delete-crs
            image: quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3
            script: |
              #!/usr/bin/env bash
              set -eux

              kubectl delete internalrequests --all