dnm: Scripts to help seed trusted task denys

Ref: https://redhat.atlassian.net/browse/EC-1539
Co-authored-by: Claude Code <noreply@anthropic.com>

Author: simonbaird

hack/manage-trusted-tasks.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o pipefail
+set -o nounset
+
+cd "$(git rev-parse --show-toplevel)"
+
+# Pull down a list of all repos in a quay org
+list_quay_repos() {
+  local quay_org="$1"
+  local next_page=""
+  while true; do
+    local url="https://quay.io/api/v1/repository?namespace=${quay_org}&public=true&limit=100"
+    if [[ -n "${next_page}" ]]; then
+      url="${url}&next_page=${next_page}"
+    fi
+    local response
+    response="$(curl -s "${url}")"
+    echo "${response}" | jq -r '.repositories[].name'
+    next_page="$(echo "${response}" | jq -r '.next_page // empty')"
+    if [[ -z "${next_page}" ]]; then
+      break
+    fi
+  done
+}
+
+# List tags for a quay repo, newest first
+list_repo_tags() {
+  local quay_org="$1"
+  local repo="$2"
+  local page=1
+  while true; do
+    local response
+    response="$(curl -s "https://quay.io/api/v1/repository/${quay_org}/${repo}/tag/?limit=100&page=${page}")"
+    echo "${response}" | jq -r '.tags[] | select(.end_ts == null) | select(.name | test("^[0-9]+\\.[0-9]+$")) | .name'
+    if [[ "$(echo "${response}" | jq -r '.has_additional')" != "true" ]]; then
+      break
+    fi
+    page=$((page + 1))
+  done
+}
+
+deny_rule() {
+  local task_name="$1"
+  local repo_ref="$2"
+  local version="$3"
+  cat <<EOF
+    - name: Expire old versions of ${task_name}
+      pattern: oci://${repo_ref}
+      versions:
+        - '<${version}'
+EOF
+}
+
+KNOWN_TASK_CATALOGS=(
+  quay.io/konflux-ci/tekton-catalog
+  quay.io/konflux-ci/integration-service-catalog
+  quay.io/konflux-ci/konflux-test-tasks
+  quay.io/konflux-ci/konflux-vanguard
+  # Todo: Are there more?
+)
+
+for c in "${KNOWN_TASK_CATALOGS[@]}"; do
+  IFS='/' read -r _ quay_org repo_prefix <<< "${c}"
+
+  # Assume task repos begin with "task-"
+  task_repos=$(list_quay_repos "${quay_org}" | grep "^${repo_prefix}/task-" | sort || true)
+
+  # Generate deny rules for versions below the current version
+  for task_repo in ${task_repos}; do
+    repo_ref="quay.io/${quay_org}/${task_repo}"
+    list_repo_tags "${quay_org}" "${task_repo}" | while read -r tag; do
+      bundle_ref="${repo_ref}:${tag}"
+      version=$(tkn bundle list "${bundle_ref}" -o yaml 2>/dev/null | yq '.metadata.labels["app.kubernetes.io/version"]' || true)
+      if [[ -n "${version}" && "${version}" != "null" ]]; then
+        deny_rule "${task_repo##*/}" "${repo_ref}" "${version}"
+      fi
+    done
+  done
+done
+

hack/seed-trusted-tasks.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o pipefail
+set -o nounset
+
+cd "$(git rev-parse --show-toplevel)"
+
+KNOWN_TASK_CATALOGS=(
+  #quay.io/konflux-ci/tekton-catalog
+  quay.io/konflux-ci/integration-service-catalog
+  #quay.io/konflux-ci/konflux-vanguard
+  #quay.io/konflux-ci/konflux-test-tasks
+  # Todo: Are there more?
+)
+
+function fetch-acceptable-bundles() {
+  for c in "${KNOWN_TASK_CATALOGS[@]}"; do
+    local quay_org
+    local repo_prefix
+    IFS='/' read -r _ quay_org repo_prefix <<< "${c}"
+
+    # Assume the acceptable bundles data is here:
+    local acceptable_bundle_ref="quay.io/${quay_org}/${repo_prefix}/data-acceptable-bundles:latest"
+
+    # We'll download it and put it here:
+    local local_data_file="${repo_prefix}-acceptable-bundle-data.json"
+
+    # Convert to yaml just to make it easier to look at
+    ec inspect policy-data --source "${acceptable_bundle_ref}" | jq > "${local_data_file}"
+
+    echo "Created $local_data_file from $acceptable_bundle_ref"
+  done
+}
+
+# Because Conforma can't use the tag from the bundle ref it has to get the version from the
+# task metadata. We'll do the same here:
+function metadata-version() {
+  local bundle_ref="$1"
+  tkn bundle list "$bundle_ref" -o json 2>/dev/null | jq -r '.metadata.labels["app.kubernetes.io/version"]'
+}
+
+# Comment out while hacking to save a little time
+#fetch-acceptable-bundles
+
+for d in *-acceptable-bundle-data.json; do
+  all_refs=$(
+    jq -r '.trusted_tasks|keys[]|select(test(":[^-]+$"))|select(test(":unknown$")|not)' $d | sed 's!oci://!!'
+  )
+
+  for ref in $all_refs; do
+    echo "Inspecting $ref"
+    echo "Found version $(metadata-version "$ref")"
+    echo ""
+  done
+done