Prod signing

.github/scripts/promote_branch.sh

@@ -263,10 +263,14 @@ add_to_parsed_tickets_json() {
         pr_url="$pr_url_input"
     fi
 
-    # Append the ticket and PR URL (if present) to the parsed JSON
-    PARSED_TICKETS_JSON="$(jq --arg ticket "$ticket" --arg pr_url "$pr_url" \
-        '. += [ {"ticket": $ticket} + (if $pr_url != "" then {"pr_url": $pr_url} else {} end) ]' \
-        <<<"$PARSED_TICKETS_JSON")"
+    # Upsert: if ticket exists, append PR to its prs array; otherwise add new entry
+    PARSED_TICKETS_JSON="$(jq --arg ticket "${ticket}" --arg pr_url "${pr_url}" '
+        if any(.[]; .ticket == $ticket) then
+            map(if .ticket == $ticket and $pr_url != "" then .prs = ((.prs + [$pr_url]) | unique) else . end)
+        else
+            . + [{ticket: $ticket, prs: (if $pr_url != "" then [$pr_url] else [] end)}]
+        end
+    ' <<<"${PARSED_TICKETS_JSON}")"
 }
 
 if [ -z "${PROMOTION_TYPE}" ]; then

.github/scripts/test_tekton_tasks.sh

@@ -62,13 +62,10 @@ apply_python_command_mocks_merge() {
       echo '#!/usr/bin/env bash'
       echo "TASK_ENTRYPOINT=("
       for w in "${entrypoint_argv[@]}"; do
-        # Tekton placeholders must stay unescaped so Tekton can substitute them
-        # (printf %q would escape the '$').  Use single quotes so that JSON
-        # values with embedded double quotes survive bash array construction.
-        # Tekton does raw text replacement on the whole script string before
-        # bash sees it, so single quotes do not prevent substitution.
+        # Do not use printf %q for Tekton placeholders: single-quoted %q output
+        # prevents Tekton from rewriting $(params.*) inside spec.steps[].script.
         if [[ "$w" == *'$('* ]]; then
-          printf "  '%s'\n" "$w"
+          printf '  "%s"\n' "$w"
         else
           printf '  %q\n' "$w"
         fi

.github/workflows/promote_branch.yaml

@@ -200,14 +200,48 @@ jobs:
         if: |
           steps.promote.outcome == 'success' && 
           inputs.update-jira-tickets == true &&
+          inputs.dry-run == false &&
           steps.promote.outputs.parsed_tickets_file != ''
-        uses: konflux-ci/release-service-automations/jira-ci@87615e00a3a699a7cc473ed93d3203624e3b86f0  # main
-        with:
-          jira_url: "https://redhat.atlassian.net"
-          promotion_type: ${{ inputs.promotion-type }}
-          metadata_file: ${{ steps.promote.outputs.parsed_tickets_file }}
-          jira_token: ${{ secrets.JIRA_TOKEN }}
-          dry_run: ${{ inputs.dry-run }}
+        env:
+          JIRA_WEBHOOK_URL: ${{ secrets.JIRA_AUTOMATION_WEBHOOK_URL }}
+          JIRA_WEBHOOK_TOKEN: ${{ secrets.JIRA_AUTOMATION_WEBHOOK_TOKEN }}
+          PARSED_TICKETS_FILE: ${{ steps.promote.outputs.parsed_tickets_file }}
+          PROMOTION_TYPE: ${{ inputs.promotion-type }}
+        run: |
+          SOURCE="${PROMOTION_TYPE%-to-*}"
+          ENVIRONMENT="${PROMOTION_TYPE#*-to-}"
+
+          PAYLOAD=$(jq --arg env "${ENVIRONMENT}" --arg src "${SOURCE}" \
+            '{tickets: ., environment: $env, source: $src}' "${PARSED_TICKETS_FILE}")
+
+          TICKET_COUNT="$(jq '.tickets | length' <<< "${PAYLOAD}")"
+          if [ "${TICKET_COUNT}" -eq 0 ]; then
+            echo "No tickets to update, skipping webhook call"
+            exit 0
+          fi
+
+          echo "Calling Jira Automation webhook for ${SOURCE} -> ${ENVIRONMENT}"
+          echo "Tickets: $(jq -r '.[].ticket' "${PARSED_TICKETS_FILE}" | tr '\n' ' ')"
+
+          set +e
+          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
+            --retry 3 --max-time 30 \
+            -X POST "${JIRA_WEBHOOK_URL}" \
+            -H "Content-Type: application/json" \
+            -H "X-Automation-Webhook-Token: ${JIRA_WEBHOOK_TOKEN}" \
+            -d "${PAYLOAD}")
+          CURL_RC=$?
+          set -e
+
+          if [ "${CURL_RC}" -ne 0 ]; then
+            echo "WARNING: curl failed with exit code ${CURL_RC}"
+            echo "Promotion was successful but Jira update may have failed."
+          elif [ "${HTTP_CODE}" -eq 200 ]; then
+            echo "Jira Automation webhook called successfully (HTTP ${HTTP_CODE})"
+          else
+            echo "WARNING: Jira Automation webhook returned HTTP ${HTTP_CODE}"
+            echo "Promotion was successful but Jira update may have failed."
+          fi
 
       - name: Set up Python
         if: |

pipelines/managed/slan-cuan-release/README.md

@@ -0,0 +1,42 @@
+# slan-cuan-release pipeline
+
+Release pipeline for Lightwell Java artifacts (slan-cuan).
+
+This pipeline orchestrates the complete release workflow for Java artifacts built by
+PNC (Project Newcastle). All per-release configuration (image reference, signing key,
+Trustify URLs, Pulp target) is derived from the Snapshot and ReleasePlanAdmission data
+via collect-data, so no pipeline parameters need to be supplied at invocation time.
+
+## Parameters
+
+| Name                    | Description                                                                                                                                                                     | Optional | Default value                                        |
+|-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|------------------------------------------------------|
+| release                 | The namespaced name (namespace/name) of the Release                                                                                                                             | No       | -                                                    |
+| releasePlan             | The namespaced name (namespace/name) of the ReleasePlan                                                                                                                         | No       | -                                                    |
+| releasePlanAdmission    | The namespaced name (namespace/name) of the ReleasePlanAdmission                                                                                                                | No       | -                                                    |
+| releaseServiceConfig    | The namespaced name (namespace/name) of the ReleaseServiceConfig                                                                                                                | No       | -                                                    |
+| snapshot                | The namespaced name (namespace/name) of the Snapshot                                                                                                                            | No       | -                                                    |
+| ociStorage              | The OCI repository where Trusted Artifacts are stored                                                                                                                           | Yes      | empty                                                |
+| ociArtifactExpiresAfter | Expiration date for trusted artifacts created in the OCI repository                                                                                                             | Yes      | 1d                                                   |
+| trustedArtifactsDebug   | Flag to enable debug logging in trusted artifacts                                                                                                                               | Yes      | ""                                                   |
+| orasOptions             | oras options to pass to Trusted Artifacts calls                                                                                                                                 | Yes      | ""                                                   |
+| dataDir                 | The location where data will be stored                                                                                                                                          | Yes      | /var/workdir/release                                 |
+| caTrustConfigMapName    | The name of the ConfigMap to read CA bundle data from                                                                                                                           | Yes      | trusted-ca                                           |
+| caTrustConfigMapKey     | The name of the key in the ConfigMap that contains the CA bundle data                                                                                                           | Yes      | ca-bundle.crt                                        |
+| catalogGitUrl           | The url to the git repo where release-service-catalog tasks are stored                                                                                                          | Yes      | https://github.com/arewm/release-service-catalog.git |
+| catalogGitRevision      | The revision in the catalogGitUrl repo to be used                                                                                                                               | Yes      | lightwell-pipeline                                   |
+| taskGitUrl              | The url to the git repo where the slan-cuan tasks are stored                                                                                                                    | Yes      | https://github.com/arewm/slan-cuan.git               |
+| taskGitRevision         | The revision in the taskGitUrl repo to be used                                                                                                                                  | Yes      | 509fb97bb20fd8c3c021c6965e6f000134d396e5             |
+| registry-auth-secret    | Kubernetes Secret name for registry authentication (.dockerconfigjson format). Points to a Docker/Podman auth config for accessing private registries                           | Yes      | registry-auth                                        |
+| force-extract           | Overwrite existing output directory if it exists. Without this flag, the extract task refuses to overwrite existing directories                                                 | Yes      | false                                                |
+| radas-config-secret     | Kubernetes Secret name containing RADAS configuration JSON. The secret must have a `config.json` key with RADAS API URL and credentials                                         | Yes      | radas-config                                         |
+| requester-id            | Requester identity for signing operations. Used for audit trails and RADAS access control. Typically an email address                                                           | Yes      | slan-cuan@org.com                                    |
+| zip-root-path           | Root of the Maven repository tree inside the ZIP archive submitted to RADAS. The ZIP file structure is <ZIP_ROOT_PATH>/<maven-layout>                                           | Yes      | repository                                           |
+| product-key             | Product key for metadata tagging. Identifies the product in RADAS records and signing logs                                                                                      | Yes      | slan-cuan                                            |
+| ignore-patterns         | Comma-separated regex patterns to exclude files from signing. Example: ".*-sources\\.jar$,.*-javadoc\\.jar$" excludes source and javadoc JARs                                   | Yes      | ""                                                   |
+| sso-secret-name         | Kubernetes Secret name with OIDC credentials. The secret must have `client-id` and `client-secret` keys for OAuth2 client credentials flow                                      | Yes      | trustify-sso                                         |
+| register-insecure       | Disable TLS verification for Trustify API calls. Set to "true" to skip certificate validation (not recommended for production)                                                  | Yes      | false                                                |
+| register-retries        | Number of retry attempts for Trustify API calls. The task will retry failed API calls this many times before giving up                                                          | Yes      | 3                                                    |
+| register-ca-cert-secret | Kubernetes Secret name for custom CA certificate (optional). The secret must have a `ca.crt` key containing the PEM-encoded CA certificate. Leave empty to use system CA bundle | Yes      | ""                                                   |
+| publish-insecure        | Disable TLS verification for Pulp API calls. Set to "true" to skip certificate validation (not recommended for production)                                                      | Yes      | false                                                |
+| publish-ca-cert-secret  | Kubernetes Secret name for custom CA certificate (optional). The secret must have a `ca.crt` key containing the PEM-encoded CA certificate. Leave empty to use system CA bundle | Yes      | ""                                                   |