diff --git a/integration-tests/rh-advisories-idempotent/README.md b/integration-tests/rh-advisories-idempotent/README.md index 0437e794e1..1e6878855d 100644 --- a/integration-tests/rh-advisories-idempotent/README.md +++ b/integration-tests/rh-advisories-idempotent/README.md @@ -57,7 +57,7 @@ This test validates idempotent re-release behavior for the `rh-advisories` pipel ## Acceptance Criteria - Second release: all major tasks (`create-advisory`, `push-snapshot`, `verify-conforma`, - `rh-sign-image`, etc.) appear in `skippedTasks` + `rh-direct-sign-image`, etc.) appear in `skippedTasks` - `advisory.url` present in second release `status.artifacts` (written by `update-cr-status-skipped` from filter result, not `create-advisory`) diff --git a/integration-tests/rh-advisories-idempotent/test.sh b/integration-tests/rh-advisories-idempotent/test.sh index 08840f8000..d53d6cf7bc 100755 --- a/integration-tests/rh-advisories-idempotent/test.sh +++ b/integration-tests/rh-advisories-idempotent/test.sh @@ -276,7 +276,7 @@ verify_release_contents() { "populate-release-notes" "embargo-check" "set-advisory-severity" - "rh-sign-image" + "rh-direct-sign-image" "rh-sign-image-cosign" "push-snapshot" "create-pyxis-image" diff --git a/integration-tests/rh-advisories-large-snapshot/README.md b/integration-tests/rh-advisories-large-snapshot/README.md index 5d3ea0e72a..19ae937ab2 100644 --- a/integration-tests/rh-advisories-large-snapshot/README.md +++ b/integration-tests/rh-advisories-large-snapshot/README.md @@ -122,7 +122,7 @@ The `test-report` finally task always runs and actively diagnoses failures: - **Pre-pipeline failures** (e.g. `generate-large-snapshot.sh` errors): the failed component, step, command, and exit code are shown. -- **Managed pipeline failures** (e.g. `apply-mapping`, `rh-sign-image`): the +- **Managed pipeline failures** (e.g. `apply-mapping`, `rh-direct-sign-image`): the `test-report` task queries the cluster directly and shows the failed task name, TaskRun name, Tekton condition message, and — if the pod has not yet been garbage-collected — the last matching error lines from the pod log diff --git a/pipelines/managed/rh-advisories/rh-advisories.yaml b/pipelines/managed/rh-advisories/rh-advisories.yaml index 9db5440192..ade17d5cfd 100644 --- a/pipelines/managed/rh-advisories/rh-advisories.yaml +++ b/pipelines/managed/rh-advisories/rh-advisories.yaml @@ -593,8 +593,8 @@ spec: - name: taskGitRevision value: "$(params.taskGitRevision)" runAfter: - - rh-sign-image - - name: rh-sign-image + - rh-direct-sign-image + - name: rh-direct-sign-image timeout: "6h00m0s" when: - input: "$(tasks.filter-already-released-advisory-images.results.skip_release)" @@ -609,19 +609,15 @@ spec: - name: revision value: $(params.taskGitRevision) - name: pathInRepo - value: tasks/managed/rh-sign-image/rh-sign-image.yaml + value: tasks/managed/rh-direct-sign-image/rh-direct-sign-image.yaml params: - name: snapshotPath value: "$(tasks.collect-data.results.snapshotSpec)" - name: dataPath value: "$(tasks.collect-data.results.data)" - - name: releasePlanAdmissionPath - value: "$(tasks.collect-data.results.releasePlanAdmission)" - name: requester value: $(tasks.extract-requester-from-release.results.output-result) - name: requestTimeout - # The RADAS timeout when it fails to receive a response is 5 mins. - # Give RADAS enough time to retry its request. value: 1800 - name: pipelineRunUid value: $(context.pipelineRun.uid) @@ -1054,7 +1050,7 @@ spec: - embargo-check - push-rpm-data-to-pyxis - run-file-updates - - rh-sign-image + - rh-direct-sign-image - rh-sign-image-cosign - set-advisory-severity - name: close-advisory-issues diff --git a/pipelines/managed/rh-push-helm-chart-to-registry-redhat-io/rh-push-helm-chart-to-registry-redhat-io.yaml b/pipelines/managed/rh-push-helm-chart-to-registry-redhat-io/rh-push-helm-chart-to-registry-redhat-io.yaml index cf1ead4b6d..6601ffd36d 100644 --- a/pipelines/managed/rh-push-helm-chart-to-registry-redhat-io/rh-push-helm-chart-to-registry-redhat-io.yaml +++ b/pipelines/managed/rh-push-helm-chart-to-registry-redhat-io/rh-push-helm-chart-to-registry-redhat-io.yaml @@ -426,8 +426,8 @@ spec: - name: taskGitRevision value: "$(params.taskGitRevision)" runAfter: - - rh-sign-image - - name: rh-sign-image + - rh-direct-sign-image + - name: rh-direct-sign-image timeout: "6h00m0s" retries: 3 taskRef: @@ -438,19 +438,15 @@ spec: - name: revision value: $(params.taskGitRevision) - name: pathInRepo - value: tasks/managed/rh-sign-image/rh-sign-image.yaml + value: tasks/managed/rh-direct-sign-image/rh-direct-sign-image.yaml params: - name: snapshotPath value: "$(tasks.collect-data.results.snapshotSpec)" - name: dataPath value: "$(tasks.collect-data.results.data)" - - name: releasePlanAdmissionPath - value: "$(tasks.collect-data.results.releasePlanAdmission)" - name: requester value: $(tasks.extract-requester-from-release.results.output-result) - name: requestTimeout - # The RADAS timeout when it fails to receive a response is 5 mins. - # Give RADAS enough time to retry its request. value: 1800 - name: pipelineRunUid value: $(context.pipelineRun.uid) diff --git a/pipelines/managed/rh-push-to-registry-redhat-io/rh-push-to-registry-redhat-io.yaml b/pipelines/managed/rh-push-to-registry-redhat-io/rh-push-to-registry-redhat-io.yaml index e6a2b85c9a..8e71e99fa8 100644 --- a/pipelines/managed/rh-push-to-registry-redhat-io/rh-push-to-registry-redhat-io.yaml +++ b/pipelines/managed/rh-push-to-registry-redhat-io/rh-push-to-registry-redhat-io.yaml @@ -397,8 +397,8 @@ spec: - name: taskGitRevision value: "$(params.taskGitRevision)" runAfter: - - rh-sign-image - - name: rh-sign-image + - rh-direct-sign-image + - name: rh-direct-sign-image timeout: "6h00m0s" retries: 3 taskRef: @@ -409,19 +409,15 @@ spec: - name: revision value: $(params.taskGitRevision) - name: pathInRepo - value: tasks/managed/rh-sign-image/rh-sign-image.yaml + value: tasks/managed/rh-direct-sign-image/rh-direct-sign-image.yaml params: - name: snapshotPath value: "$(tasks.collect-data.results.snapshotSpec)" - name: dataPath value: "$(tasks.collect-data.results.data)" - - name: releasePlanAdmissionPath - value: "$(tasks.collect-data.results.releasePlanAdmission)" - name: requester value: $(tasks.extract-requester-from-release.results.output-result) - name: requestTimeout - # The RADAS timeout when it fails to receive a response is 5 mins. - # Give RADAS enough time to retry its request. value: 1800 - name: pipelineRunUid value: $(context.pipelineRun.uid) diff --git a/tasks/managed/publish-pyxis-repository/README.md b/tasks/managed/publish-pyxis-repository/README.md index 96868e3b96..e53cfadf3e 100644 --- a/tasks/managed/publish-pyxis-repository/README.md +++ b/tasks/managed/publish-pyxis-repository/README.md @@ -21,7 +21,7 @@ requires_terms=true), one repository string per line, e.g. "rhtas/cosign-rhel9". Only standard (non-flatpak) repositories are included; flatpak repos are never added. Note: This task runs quite early on in the pipeline, because we need the result it produces -for the signing tasks (and `rh-sign-image` runs quite early to begin with). So this means +for the signing tasks (and `rh-direct-sign-image` runs quite early to begin with). So this means that if you're releasing to a repo for the first time, the repository might get published even before the actual image is pushed and published. But we checked with RHEC team and this shouldn't cause any problems, because RHEC will ignore repos with no published images. diff --git a/tasks/managed/publish-pyxis-repository/publish-pyxis-repository.yaml b/tasks/managed/publish-pyxis-repository/publish-pyxis-repository.yaml index 8ff7bac153..630d3f4c9a 100644 --- a/tasks/managed/publish-pyxis-repository/publish-pyxis-repository.yaml +++ b/tasks/managed/publish-pyxis-repository/publish-pyxis-repository.yaml @@ -29,7 +29,7 @@ spec: Only standard (non-flatpak) repositories are included; flatpak repos are never added. Note: This task runs quite early on in the pipeline, because we need the result it produces - for the signing tasks (and `rh-sign-image` runs quite early to begin with). So this means + for the signing tasks (and `rh-direct-sign-image` runs quite early to begin with). So this means that if you're releasing to a repo for the first time, the repository might get published even before the actual image is pushed and published. But we checked with RHEC team and this shouldn't cause any problems, because RHEC will ignore repos with no published images. diff --git a/tasks/managed/rh-direct-sign-image/README.md b/tasks/managed/rh-direct-sign-image/README.md new file mode 100644 index 0000000000..9b9f4f9654 --- /dev/null +++ b/tasks/managed/rh-direct-sign-image/README.md @@ -0,0 +1,33 @@ +# rh-direct-sign-image + +Task to create internalrequests to directly sign snapshot components + +## Parameters + +| Name | Description | Optional | Default value | +|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|---------------------------------------------------| +| snapshotPath | Path to the JSON string of the mapped Snapshot spec in the data workspace | No | - | +| dataPath | Path to the JSON string of the merged data to use in the data workspace | No | - | +| requester | Name of the user that requested the signing, for auditing purposes | No | - | +| requestTimeout | InternalRequest timeout | Yes | 1800 | +| concurrentLimit | The maximum number of signing requests to run in parallel | Yes | 8 | +| pipelineRunUid | The uid of the current pipelineRun. Used as a label value when creating internal requests | No | - | +| pyxisServer | The server type to use. Options are 'production','production-internal','stage-internal' and 'stage' | Yes | production | +| pyxisSecret | The kubernetes secret to use to authenticate to Pyxis. It needs to contain two keys: key and cert | No | - | +| batchLimit | size of batch attributes to send to internal-request. As internal request arguments are need to be strings, size here represent maximal string length of `references` and `manifest_digests` sent to internal request | Yes | 15000 | +| signRegistryAccessPath | The relative path in the workspace to a text file that contains a list of repositories that needs registry.access.redhat.com image references to be signed (i.e. requires_terms=true), one repository string per line, e.g. "rhtas/cosign-rhel9" | No | - | +| ociStorage | The OCI repository where the Trusted Artifacts are stored | Yes | empty | +| ociArtifactExpiresAfter | Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire | Yes | 1d | +| trustedArtifactsDebug | Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable | Yes | "" | +| orasOptions | oras options to pass to Trusted Artifacts calls | Yes | "" | +| sourceDataArtifact | Location of trusted artifacts to be used to populate data directory | Yes | "" | +| dataDir | The location where data will be stored | Yes | /var/workdir/release | +| taskGitUrl | The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored | No | - | +| taskGitRevision | The revision in the taskGitUrl repo to be used | No | - | +| signingRepo | Git repository URL containing the signing tasks | Yes | https://gitlab.cee.redhat.com/signing/signing.git | +| signingRevision | Git revision (branch, tag, or commit) in the signing repository | Yes | main | +| signPipeline | Name of the internal pipeline to use for container signing | Yes | container-signing | +| signPipelineServiceAccount | Service account to use for the signing pipeline | Yes | signing-pipeline-sa | +| pipelineImage | The image to use for the signing pipeline | Yes | quay.io/konflux-ci/signing:latest | +| caTrustConfigMapName | The name of the ConfigMap to read CA bundle data from | Yes | trusted-ca | +| caTrustConfigMapKey | The name of the key in the ConfigMap that contains the CA bundle data | Yes | ca-bundle.crt | diff --git a/tasks/managed/rh-direct-sign-image/rh-direct-sign-image.yaml b/tasks/managed/rh-direct-sign-image/rh-direct-sign-image.yaml new file mode 100644 index 0000000000..29c4ebb2fa --- /dev/null +++ b/tasks/managed/rh-direct-sign-image/rh-direct-sign-image.yaml @@ -0,0 +1,251 @@ +--- +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: rh-direct-sign-image + annotations: + tekton.dev/pipelines.minVersion: "0.12.1" + tekton.dev/tags: release +spec: + description: |- + Task to create internalrequests to directly sign snapshot components + params: + - name: snapshotPath + description: Path to the JSON string of the mapped Snapshot spec in the data workspace + type: string + - name: dataPath + description: Path to the JSON string of the merged data to use in the data workspace + type: string + - name: requester + type: string + description: Name of the user that requested the signing, for auditing purposes + - name: requestTimeout + type: string + default: "1800" + description: InternalRequest timeout + - name: concurrentLimit + type: string + description: The maximum number of signing requests to run in parallel + default: 8 + - name: pipelineRunUid + type: string + description: >- + The uid of the current pipelineRun. Used as a label value when creating internal requests + - name: pyxisServer + type: string + description: >- + The server type to use. Options are 'production','production-internal','stage-internal' and 'stage' + default: production + - name: pyxisSecret + type: string + description: | + The kubernetes secret to use to authenticate to Pyxis. It needs to contain two keys: key and cert + - name: batchLimit + type: string + description: | + size of batch attributes to send to internal-request. As internal request arguments are need to be + strings, size here represent maximal string length of `references` and `manifest_digests` sent to + internal request + default: 15000 + - name: signRegistryAccessPath + type: string + description: | + The relative path in the workspace to a text file that contains a list of repositories + that needs registry.access.redhat.com image references to be signed (i.e. + requires_terms=true), one repository string per line, e.g. "rhtas/cosign-rhel9" + - name: ociStorage + description: The OCI repository where the Trusted Artifacts are stored + type: string + default: "empty" + - name: ociArtifactExpiresAfter + description: Expiration date for the trusted artifacts created in the + OCI repository. An empty string means the artifacts do not expire + type: string + default: "1d" + - name: trustedArtifactsDebug + description: >- + Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable + type: string + default: "" + - name: orasOptions + description: oras options to pass to Trusted Artifacts calls + type: string + default: "" + - name: sourceDataArtifact + type: string + description: Location of trusted artifacts to be used to populate data directory + default: "" + - name: dataDir + description: The location where data will be stored + type: string + default: /var/workdir/release + - name: taskGitUrl + type: string + description: >- + The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored + - name: taskGitRevision + type: string + description: The revision in the taskGitUrl repo to be used + - name: signingRepo + type: string + description: Git repository URL containing the signing tasks + default: "https://gitlab.cee.redhat.com/signing/signing.git" + - name: signingRevision + type: string + description: Git revision (branch, tag, or commit) in the signing repository + default: "main" + - name: signPipeline + type: string + description: Name of the internal pipeline to use for container signing + default: "container-signing" + - name: signPipelineServiceAccount + type: string + description: Service account to use for the signing pipeline + default: "signing-pipeline-sa" + - name: pipelineImage + type: string + description: The image to use for the signing pipeline + default: quay.io/konflux-ci/signing:latest + - name: caTrustConfigMapName + type: string + description: The name of the ConfigMap to read CA bundle data from + default: trusted-ca + - name: caTrustConfigMapKey + type: string + description: The name of the key in the ConfigMap that contains the CA bundle data + default: ca-bundle.crt + results: + - description: Produced trusted data artifact + name: sourceDataArtifact + type: string + volumes: + - name: workdir + emptyDir: {} + - name: pyxis-secret-vol + secret: + secretName: $(params.pyxisSecret) + defaultMode: 0444 + - name: trusted-ca + configMap: + name: $(params.caTrustConfigMapName) + items: + - key: $(params.caTrustConfigMapKey) + path: ca-bundle.crt + optional: true + + stepTemplate: + volumeMounts: + - mountPath: /var/workdir + name: workdir + - name: trusted-ca + mountPath: /mnt/trusted-ca + readOnly: true + securityContext: + runAsUser: 1001 + env: + - name: IMAGE_EXPIRES_AFTER + value: $(params.ociArtifactExpiresAfter) + - name: "ORAS_OPTIONS" + value: "$(params.orasOptions)" + - name: "DEBUG" + value: "$(params.trustedArtifactsDebug)" + steps: + - name: use-trusted-artifact + computeResources: + limits: + memory: 64Mi + cpu: 100m + requests: + memory: 64Mi + cpu: 30m + ref: + resolver: "git" + params: + - name: url + value: $(params.taskGitUrl) + - name: revision + value: $(params.taskGitRevision) + - name: pathInRepo + value: stepactions/use-trusted-artifact/use-trusted-artifact.yaml + params: + - name: workDir + value: $(params.dataDir) + - name: sourceDataArtifact + value: $(params.sourceDataArtifact) + + - name: sign-image + image: quay.io/konflux-ci/release-service-utils@sha256:a2c2fbf89bced4c0421f6a2237f467a94fa38c0b722e4c32368c4d291dbc7323 + computeResources: + limits: + memory: 4Gi + cpu: "2" + requests: + memory: 4Gi + cpu: "2" + volumeMounts: + - name: pyxis-secret-vol + mountPath: "/etc/secrets" + env: + - name: PYXIS_CERT_PATH + value: /etc/secrets/cert + - name: PYXIS_KEY_PATH + value: /etc/secrets/key + command: + - rh_direct_sign_image.py + args: + - "--pyxis-server" + - "$(params.pyxisServer)" + - "--snapshot" + - "$(params.dataDir)/$(params.snapshotPath)" + - "--data-file" + - "$(params.dataDir)/$(params.dataPath)" + - "--sign-registry-access-file" + - "$(params.dataDir)/$(params.signRegistryAccessPath)" + - "--batch-max-size" + - "$(params.batchLimit)" + - "--requester" + - "$(params.requester)" + - "--pipeline" + - "$(params.signPipeline)" + - "--service-account" + - "$(params.signPipelineServiceAccount)" + - "--request-timeout" + - "$(params.requestTimeout)" + - "--task-id" + - "$(context.taskRun.uid)" + - "--pipelinerun-uid" + - "$(params.pipelineRunUid)" + - "--signing-repo" + - "$(params.signingRepo)" + - "--signing-revision" + - "$(params.signingRevision)" + - "--concurrent-limit" + - "$(params.concurrentLimit)" + - "--pipeline-image" + - "$(params.pipelineImage)" + - "--submit-requests" + + - name: create-trusted-artifact + computeResources: + limits: + memory: 128Mi + cpu: 500m + requests: + memory: 128Mi + cpu: 250m + ref: + resolver: "git" + params: + - name: url + value: "$(params.taskGitUrl)" + - name: revision + value: "$(params.taskGitRevision)" + - name: pathInRepo + value: stepactions/create-trusted-artifact/create-trusted-artifact.yaml + params: + - name: ociStorage + value: $(params.ociStorage) + - name: workDir + value: $(params.dataDir) + - name: sourceDataArtifact + value: $(results.sourceDataArtifact.path) diff --git a/tasks/managed/rh-direct-sign-image/tests/mocks.yaml b/tasks/managed/rh-direct-sign-image/tests/mocks.yaml new file mode 100644 index 0000000000..29773dcfa8 --- /dev/null +++ b/tasks/managed/rh-direct-sign-image/tests/mocks.yaml @@ -0,0 +1,5 @@ +--- +# Declarative mocks for Tekton tests of this task (Python entrypoint). Rendered +# by .github/scripts/render_python_task_mocks_from_yaml.py when +# test_tekton_tasks.sh runs. +version: 1 diff --git a/tasks/managed/rh-direct-sign-image/tests/mocks/rh_direct_sign_image.py b/tasks/managed/rh-direct-sign-image/tests/mocks/rh_direct_sign_image.py new file mode 100644 index 0000000000..16c46256c0 --- /dev/null +++ b/tasks/managed/rh-direct-sign-image/tests/mocks/rh_direct_sign_image.py @@ -0,0 +1,4 @@ +#!/usr/bin/env bash +set -eux +echo "Mock rh_direct_sign_image.py called with: $*" +echo "$*" >> "${DATA_DIR}/mock_rh_direct_sign_image.txt" diff --git a/tasks/managed/rh-direct-sign-image/tests/pre-apply-task-hook.sh b/tasks/managed/rh-direct-sign-image/tests/pre-apply-task-hook.sh new file mode 100755 index 0000000000..c7b0985b2b --- /dev/null +++ b/tasks/managed/rh-direct-sign-image/tests/pre-apply-task-hook.sh @@ -0,0 +1,10 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Inject DATA_DIR env var into the sign-image step so the mock binary can use it +# without relying on Tekton parameter substitution inside the mock script itself +yq -i '.spec.steps[1].env += [{"name": "DATA_DIR", "value": "$(params.dataDir)"}]' "$1" + +# Create a dummy pyxis secret (and delete it first if it exists) +kubectl delete secret test-pyxis-image-cert --ignore-not-found +kubectl create secret generic test-pyxis-image-cert --from-literal=cert=mycert --from-literal=key=mykey diff --git a/tasks/managed/rh-direct-sign-image/tests/test-rh-direct-sign-image.yaml b/tasks/managed/rh-direct-sign-image/tests/test-rh-direct-sign-image.yaml new file mode 100644 index 0000000000..6c984fd50a --- /dev/null +++ b/tasks/managed/rh-direct-sign-image/tests/test-rh-direct-sign-image.yaml @@ -0,0 +1,155 @@ +--- +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: test-rh-direct-sign-image +spec: + description: Test the happy path for rh-direct-sign-image + params: + - name: ociStorage + description: The OCI repository where the Trusted Artifacts are stored. + type: string + - name: ociArtifactExpiresAfter + description: Expiration date for the trusted artifacts created in the + OCI repository. An empty string means the artifacts do not expire. + type: string + default: "1d" + - name: orasOptions + description: oras options to pass to Trusted Artifacts calls + type: string + default: "--insecure" + - name: trustedArtifactsDebug + description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable. + type: string + default: "" + - name: dataDir + description: The location where data will be stored + type: string + tasks: + - name: setup + taskSpec: + results: + - name: sourceDataArtifact + type: string + volumes: + - name: workdir + emptyDir: {} + stepTemplate: + volumeMounts: + - mountPath: /var/workdir + name: workdir + env: + - name: IMAGE_EXPIRES_AFTER + value: $(params.ociArtifactExpiresAfter) + - name: "ORAS_OPTIONS" + value: "$(params.orasOptions)" + - name: "DEBUG" + value: "$(params.trustedArtifactsDebug)" + steps: + - name: create-trusted-artifact + ref: + name: create-trusted-artifact + params: + - name: ociStorage + value: $(params.ociStorage) + - name: workDir + value: $(params.dataDir) + - name: sourceDataArtifact + value: $(results.sourceDataArtifact.path) + - name: run-task + taskRef: + name: rh-direct-sign-image + params: + - name: requester + value: testuser + - name: pipelineRunUid + value: $(context.pipelineRun.uid) + - name: snapshotPath + value: $(context.pipelineRun.uid)/snapshot_spec.json + - name: dataPath + value: $(context.pipelineRun.uid)/data.json + - name: pyxisSecret + value: test-pyxis-image-cert + - name: pyxisServer + value: production + - name: signRegistryAccessPath + value: $(context.pipelineRun.uid)/signRegistryAccess.txt + - name: ociStorage + value: $(params.ociStorage) + - name: orasOptions + value: $(params.orasOptions) + - name: sourceDataArtifact + value: "$(tasks.setup.results.sourceDataArtifact)=$(params.dataDir)" + - name: dataDir + value: $(params.dataDir) + - name: trustedArtifactsDebug + value: $(params.trustedArtifactsDebug) + - name: taskGitUrl + value: "http://localhost" + - name: taskGitRevision + value: "main" + runAfter: + - setup + - name: check-result + params: + - name: sourceDataArtifact + value: "$(tasks.run-task.results.sourceDataArtifact)=$(params.dataDir)" + taskSpec: + params: + - name: sourceDataArtifact + type: string + volumes: + - name: workdir + emptyDir: {} + stepTemplate: + volumeMounts: + - mountPath: /var/workdir + name: workdir + env: + - name: IMAGE_EXPIRES_AFTER + value: $(params.ociArtifactExpiresAfter) + - name: "ORAS_OPTIONS" + value: "$(params.orasOptions)" + - name: "DEBUG" + value: "$(params.trustedArtifactsDebug)" + steps: + - name: use-trusted-artifact + ref: + name: use-trusted-artifact + params: + - name: workDir + value: $(params.dataDir) + - name: sourceDataArtifact + value: $(params.sourceDataArtifact) + - name: check-result + image: quay.io/konflux-ci/release-service-utils@sha256:3cb03b14ac9d90ff27070036ce2b50712e65aa285daeb28852254a745bb25dfc + script: | + #!/usr/bin/env bash + set -euxo pipefail + + mock_file="$(params.dataDir)/mock_rh_direct_sign_image.txt" + if [ ! -f "${mock_file}" ]; then + echo "rh_direct_sign_image was not called" + exit 1 + fi + + args=$(cat "${mock_file}") + + if ! echo "${args}" | grep -q -- "--requester testuser"; then + echo "Expected --requester testuser in args: ${args}" + exit 1 + fi + + if ! echo "${args}" | grep -q -- "--pyxis-server production"; then + echo "Expected --pyxis-server production in args: ${args}" + exit 1 + fi + + if ! echo "${args}" | grep -q -- "--submit-requests"; then + echo "Expected --submit-requests in args: ${args}" + exit 1 + fi + + echo "All checks passed" + runAfter: + - run-task