fix: allow additional tags in validate-helm-chart-snapshot

Require at least one tag to match oci_version but permit extra tags
(e.g. release_timestamp, static versions). Add e2e coverage with
mixed tags in the RPA and a new unit test case.

Assisted-by: Cursor AI
Signed-off-by: Scott Wickersham <swickers@redhat.com>

Author: swickersh

integration-tests/rh-push-helm-chart-to-registry-redhat-io/README.md

@@ -35,7 +35,7 @@ must remain `caching-helm-test-rhel9` because:
 
 - `validate-helm-chart-snapshot` checks that the OCI `org.opencontainers.image.title` matches the delivery repo basename
 - `publish-pyxis-repository` requires the delivery repo to already exist in Pyxis stage
-- The Pyxis repo (`dev-release-team-tenant/caching-helm-test-rhel9`) is defined in `pyxis-repo-configs/products/test-helm/caching-helm-test.yaml`
+- The Pyxis repo (`dev-release-team-tenant/caching-helm-test-rhel9`) is defined in [pyxis-repo-configs](https://gitlab.cee.redhat.com/releng/pyxis-repo-configs/-/blob/main/products/test-helm/caching-helm-test.yaml)
 
 To decouple the K8s name from the image basename, the test uses two mechanisms:
 

integration-tests/rh-push-helm-chart-to-registry-redhat-io/resources/managed/rpa.yaml

@@ -19,11 +19,13 @@ spec:
       defaults:
         tags:
           - "{{ oci_version }}"
+          - "{{ release_timestamp }}"
+          - "v3.3"
         pushSourceContainer: false
       components:
         - name: ${component_name}
           repositories:
-            - url: quay.io/redhat-pending/dev-release-team-tenant----caching-helm-test-rhel9
+            - url: registry.stage.redhat.io/dev-release-team-tenant/caching-helm-test-rhel9
     fileUpdates:
       - paths:
           - path: data/teams/stonesoup/users/shebert.yml

tasks/managed/validate-helm-chart-snapshot/tests/test-validate-helm-chart-snapshot-fail-tag-mismatch.yaml

@@ -7,7 +7,7 @@ metadata:
     test/assert-task-failure: "run-task"
 spec:
   description: |
-    Run validate-helm-chart-snapshot with a tag that does not match the chart version
+    Run validate-helm-chart-snapshot where no tag matches the chart version
     (tag "0.2.0" vs chart version "1.0.0+buildmeta"). The task should fail.
   params:
     - name: ociStorage

tasks/managed/validate-helm-chart-snapshot/tests/test-validate-helm-chart-snapshot-success-extra-tags.yaml

@@ -0,0 +1,106 @@
+---
+apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: test-validate-helm-chart-snapshot-success-extra-tags
+spec:
+  description: |
+    Run validate-helm-chart-snapshot with multiple tags where one matches the chart version
+    and others do not. The task should succeed because at least one tag matches.
+  params:
+    - name: ociStorage
+      description: The OCI repository where the Trusted Artifacts are stored.
+      type: string
+      default: ""
+    - name: ociArtifactExpiresAfter
+      description: Expiration date for the trusted artifacts created in the
+        OCI repository. An empty string means the artifacts do not expire.
+      type: string
+      default: "1d"
+    - name: orasOptions
+      description: oras options to pass to Trusted Artifacts calls
+      type: string
+      default: "--insecure"
+    - name: trustedArtifactsDebug
+      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable.
+      type: string
+      default: ""
+    - name: dataDir
+      description: The location where data will be stored
+      type: string
+      default: "/var/workdir/release"
+  tasks:
+    - name: setup
+      taskSpec:
+        results:
+          - name: sourceDataArtifact
+            type: string
+        volumes:
+          - name: workdir
+            emptyDir: {}
+        stepTemplate:
+          volumeMounts:
+            - mountPath: /var/workdir
+              name: workdir
+          env:
+            - name: IMAGE_EXPIRES_AFTER
+              value: $(params.ociArtifactExpiresAfter)
+            - name: "ORAS_OPTIONS"
+              value: "$(params.orasOptions)"
+            - name: "DEBUG"
+              value: "$(params.trustedArtifactsDebug)"
+        steps:
+          - name: add-snapshot
+            image: quay.io/konflux-ci/release-service-utils@sha256:3cb03b14ac9d90ff27070036ce2b50712e65aa285daeb28852254a745bb25dfc
+            script: |
+              #!/usr/bin/env bash
+              set -eux
+
+              mkdir -p "$(params.dataDir)/$(context.pipelineRun.uid)"
+              cat > "$(params.dataDir)/$(context.pipelineRun.uid)/mapped.json" << 'EOF'
+              {
+                "application": "helm-app",
+                "components": [
+                  {
+                    "name": "mychart",
+                    "containerImage": "quay.io/tenant/mychart@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+                    "repositories": [
+                      {
+                        "url": "quay.io/redhat-prod/acme----mychart",
+                        "tags": ["1.0.0_buildmeta", "v1.0", "latest"]
+                      }
+                    ]
+                  }
+                ]
+              }
+              EOF
+          - name: create-trusted-artifact
+            ref:
+              name: create-trusted-artifact
+            params:
+              - name: ociStorage
+                value: $(params.ociStorage)
+              - name: workDir
+                value: $(params.dataDir)
+              - name: sourceDataArtifact
+                value: $(results.sourceDataArtifact.path)
+    - name: run-task
+      taskRef:
+        name: validate-helm-chart-snapshot
+      params:
+        - name: snapshotPath
+          value: $(context.pipelineRun.uid)/mapped.json
+        - name: ociStorage
+          value: $(params.ociStorage)
+        - name: orasOptions
+          value: $(params.orasOptions)
+        - name: sourceDataArtifact
+          value: "$(tasks.setup.results.sourceDataArtifact)=$(params.dataDir)"
+        - name: dataDir
+          value: $(params.dataDir)
+        - name: taskGitUrl
+          value: "http://localhost"
+        - name: taskGitRevision
+          value: "main"
+      runAfter:
+        - setup

tasks/managed/validate-helm-chart-snapshot/validate-helm-chart-snapshot.yaml

@@ -124,16 +124,6 @@ spec:
           exit 1
         fi
 
-        # Map OCI tag to SemVer: registry tags cannot contain '+'; Helm uses first '_' as build-metadata separator.
-        oci_tag_to_version() {
-          local t="$1"
-          if [[ "$t" == *_* ]]; then
-            echo "${t/_/+}"
-          else
-            echo "$t"
-          fi
-        }
-
         # Basename of delivery repo path (after ---- to /), last segment.
         delivery_repo_basename() {
           local url="$1"
@@ -186,15 +176,18 @@ spec:
               echo "Error: component (${name}) repository (${url}) has no tags" >&2
               exit 1
             fi
-            for ((k = 0; k < num_tags; k++)); do
-              tag=$(jq -r --argjson k "$k" '.tags[$k]' <<< "$repo")
-              mapped=$(oci_tag_to_version "$tag")
-              if [[ "$mapped" != "$version" ]]; then
-                echo "Error: component (${name}) tag (${tag}) normalized to (${mapped}) does not match" \
-                  "chart version (${version})" >&2
-                exit 1
-              fi
-            done
+            {
+              read -r version_found
+              read -r all_tags
+            } < <(jq -r --arg ver "$version" '
+              ([.tags[] | sub("_"; "+") == $ver] | any),
+              (.tags | join(", "))
+            ' <<< "$repo")
+            if [[ "$version_found" != "true" ]]; then
+              echo "Error: component (${name}) repository (${url}) — none of the tags" \
+                "[${all_tags}] match chart version (${version})" >&2
+              exit 1
+            fi
           done
           echo "Validated Helm OCI artifact for component (${name}) chart (${title}) version (${version})"
         done