docker-build.yaml

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  creationTimestamp: null
  labels:
    pipelines.openshift.io/runtime: generic
    pipelines.openshift.io/strategy: docker
    pipelines.openshift.io/used-by: build-cloud
  name: docker-build
spec:
  description: |
    This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization.

    _Uses `buildah` to create a multi-platform container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. This pipeline requires that the [multi platform controller](https://github.com/konflux-ci/multi-platform-controller) is deployed and configured on your Konflux instance. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://enterprisecontract.dev/docs/ec-policies/release_policy.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks.
    This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-multi-platform-oci-ta?tab=tags)_
  finally:
  - name: show-sbom
    params:
    - name: IMAGE_URL
      value: $(tasks.build-image-index.results.IMAGE_URL)
    taskRef:
      params:
      - name: name
        value: show-sbom
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:04f15cbce548e1db7770eee3f155ccb2cc0140a6c371dc67e9a34d83673ea0c0
      - name: kind
        value: task
      resolver: bundles
  params:
  - default:
    - linux/x86_64
    - linux/arm64
    - linux/ppc64le
    - linux/s390x
    description: List of platforms to build the container images on. The available
      set of values is determined by the configuration of the multi-platform-controller.
    name: build-platforms
    type: array
  - default: --all-projects --org=3e1a4cca-ebfb-495f-b64c-3cc960d566b4 --exclude=test*,vendor,third_party
    description: Append arguments to Snyk code command.
    name: snyk-args
    type: string
  - default: "true"
    description: Build a source image.
    name: build-source-image
    type: string
  - default: "false"
    description: 'Enable in-development package managers. WARNING: the behavior may
      change at any time without notice. Use at your own risk.'
    name: prefetch-input-dev-package-managers
  - default: []
    description: Additional image tags
    name: additional-tags
    type: array
  - description: Source Repository URL
    name: git-url
    type: string
  - default: ""
    description: Revision of the Source Repository
    name: revision
    type: string
  - description: Fully Qualified Output Image
    name: output-image
    type: string
  - default: .
    description: Path to the source code of an application's component from where
      to build image.
    name: path-context
    type: string
  - default: Dockerfile
    description: Path to the Dockerfile inside the context specified by parameter
      path-context
    name: dockerfile
    type: string
  - default: "false"
    description: Force rebuild image
    name: rebuild
    type: string
  - default: "false"
    description: Skip checks against built image
    name: skip-checks
    type: string
  - default: "false"
    description: Execute the build with network isolation
    name: hermetic
    type: string
  - default: ""
    description: Build dependencies to be prefetched by Cachi2
    name: prefetch-input
    type: string
  - default: ""
    description: Image tag expiration time, time values could be something like 1h,
      2d, 3w for hours, days, and weeks, respectively.
    name: image-expires-after
  - default: "true"
    description: Add built image into an OCI image index
    name: build-image-index
    type: string
  - default: []
    description: Array of --build-arg values ("arg=value" strings) for buildah
    name: build-args
    type: array
  - default: ""
    description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file
    name: build-args-file
    type: string
  results:
  - description: ""
    name: IMAGE_URL
    value: $(tasks.build-image-index.results.IMAGE_URL)
  - description: ""
    name: IMAGE_DIGEST
    value: $(tasks.build-image-index.results.IMAGE_DIGEST)
  - description: ""
    name: CHAINS-GIT_URL
    value: $(tasks.clone-repository.results.url)
  - description: ""
    name: CHAINS-GIT_COMMIT
    value: $(tasks.clone-repository.results.commit)
  tasks:
  - name: sast-snyk-check
    params:
    - name: ARGS
      value: $(params.snyk-args)
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    - name: CACHI2_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: sast-snyk-check-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.3@sha256:540f585f8abc3790e9e1285330d5610c1101173d9b26a61924586c220e4024e6
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: prefetch-dependencies
    params:
    - name: dev-package-managers
      value: $(params.prefetch-input-dev-package-managers)
    - name: input
      value: $(params.prefetch-input)
    - name: SOURCE_ARTIFACT
      value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
    - name: ociStorage
      value: $(params.output-image).prefetch
    - name: ociArtifactExpiresAfter
      value: $(params.image-expires-after)
    runAfter:
    - clone-repository
    taskRef:
      params:
      - name: name
        value: prefetch-dependencies-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.2@sha256:786a6601c654a48e32ea51b2636982d2e096da3027ea701009ca956b74a7d400
      - name: kind
        value: task
      resolver: bundles
    workspaces:
    - name: git-basic-auth
      workspace: git-auth
    - name: netrc
      workspace: netrc
  - name: apply-tags
    params:
    - name: ADDITIONAL_TAGS
      value: $(params.additional-tags[*])
    - name: IMAGE
      value: $(tasks.build-image-index.results.IMAGE_URL)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: apply-tags
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.1@sha256:e1d365ce85d6448f6ebd0d0a000d0f45b694950b7545a2c34bfbcf992c80df61
      - name: kind
        value: task
      resolver: bundles
  - name: init
    params:
    - name: image-url
      value: $(params.output-image)
    - name: rebuild
      value: $(params.rebuild)
    - name: skip-checks
      value: $(params.skip-checks)
    taskRef:
      params:
      - name: name
        value: init
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:2f59e9a3c20ce4509356389d327087213cc82c079b30811935837791da140f9f
      - name: kind
        value: task
      resolver: bundles
  - name: clone-repository
    params:
    - name: url
      value: $(params.git-url)
    - name: revision
      value: $(params.revision)
    - name: ociStorage
      value: $(params.output-image).git
    - name: ociArtifactExpiresAfter
      value: $(params.image-expires-after)
    runAfter:
    - init
    taskRef:
      params:
      - name: name
        value: git-clone-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:9709088bf3c581d4763e9804d9ee3a1f06ad6a61c23237277057c4f0cdc4f9c3
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(tasks.init.results.build)
      operator: in
      values:
      - "true"
    workspaces:
    - name: basic-auth
      workspace: git-auth
  - matrix:
      params:
      - name: PLATFORM
        value:
        - $(params.build-platforms)
    name: build-images
    params:
    - name: IMAGE
      value: $(params.output-image)
    - name: DOCKERFILE
      value: $(params.dockerfile)
    - name: CONTEXT
      value: $(params.path-context)
    - name: HERMETIC
      value: $(params.hermetic)
    - name: PREFETCH_INPUT
      value: $(params.prefetch-input)
    - name: IMAGE_EXPIRES_AFTER
      value: $(params.image-expires-after)
    - name: COMMIT_SHA
      value: $(tasks.clone-repository.results.commit)
    - name: BUILD_ARGS
      value:
      - $(params.build-args[*])
    - name: BUILD_ARGS_FILE
      value: $(params.build-args-file)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    - name: CACHI2_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
    - name: IMAGE_APPEND_PLATFORM
      value: "true"
    runAfter:
    - prefetch-dependencies
    taskRef:
      params:
      - name: name
        value: buildah-remote-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.4@sha256:58fb95e010b84e3b7949972a07c98d25fea68b474759891ac6ac539f325b0581
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(tasks.init.results.build)
      operator: in
      values:
      - "true"
  - name: build-image-index
    params:
    - name: IMAGE
      value: $(params.output-image)
    - name: COMMIT_SHA
      value: $(tasks.clone-repository.results.commit)
    - name: IMAGE_EXPIRES_AFTER
      value: $(params.image-expires-after)
    - name: ALWAYS_BUILD_INDEX
      value: $(params.build-image-index)
    - name: IMAGES
      value:
      - $(tasks.build-images.results.IMAGE_REF[*])
    runAfter:
    - build-images
    taskRef:
      params:
      - name: name
        value: build-image-index
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:d34e4245b767c5b1b5edbbad9fc9cf8050cf19a69c8e55856479848405c596ec
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(tasks.init.results.build)
      operator: in
      values:
      - "true"
  - name: build-source-image
    params:
    - name: BINARY_IMAGE
      value: $(params.output-image)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    - name: CACHI2_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: source-build-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.2@sha256:ea2316bcef60fdbc6d89bb34d343d9157e89e786504fb68e223c04a7486d9e91
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(tasks.init.results.build)
      operator: in
      values:
      - "true"
    - input: $(params.build-source-image)
      operator: in
      values:
      - "true"
  - name: deprecated-base-image-check
    params:
    - name: IMAGE_URL
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: IMAGE_DIGEST
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: deprecated-image-check
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:5d63b920b71192906fe4d6c4903f594e6f34c5edcff9d21714a08b5edcfbc667
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: clair-scan
    params:
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: clair-scan
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.2@sha256:03383b5a8674edef0ae184dd81f00386017624a5af255cb0b5803d7659483ba5
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: ecosystem-cert-preflight-checks
    params:
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: ecosystem-cert-preflight-checks
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:2ad615f9b8141ed2e0b060ebda366ce43cf55a9dd7c98e2d93970ff328dca8b2
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: clamav-scan
    params:
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: clamav-scan
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.2@sha256:c30c12681b02eb4b83aeb4021d0e714a72db4d1d3bb14579652f4d1a763473ab
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: sast-shell-check
    params:
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    - name: CACHI2_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: sast-shell-check-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:8e817af22b04305676597a556a975bde8552949ca2bf8918bf62414f135f93c8
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: sast-unicode-check
    params:
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    - name: CACHI2_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: sast-unicode-check-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.1@sha256:b9c3dfe732a0d9581c75d07d59043f675ddcbe5e9a3152daad99076bedfd5b85
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: push-dockerfile
    params:
    - name: IMAGE
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: IMAGE_DIGEST
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: DOCKERFILE
      value: $(params.dockerfile)
    - name: CONTEXT
      value: $(params.path-context)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: push-dockerfile-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:f9e6e6afef13b5a1333a6b3a3d0ba98c815a723d7b5450dd0279f416c0c203a5
      - name: kind
        value: task
      resolver: bundles
  - name: rpms-signature-scan
    params:
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: rpms-signature-scan
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:d00d159c370e3c99447516970c316ef57dfd27c29e0ce3cff50727c9c40936d8
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  workspaces:
  - name: git-auth
    optional: true
  - name: netrc
    optional: true