From ede97a5959f1c05dfb00e17de6e0a96948ec79f2 Mon Sep 17 00:00:00 2001
From: Steven Skeard <sskeard@redhat.com>
Date: Fri, 3 Oct 2025 09:48:29 -0400
Subject: [PATCH] chore(KONFLUX-6210): fix and set name and cpe label for
 recert For https://issues.redhat.com/browse/KONFLUX-6210, clair needs access
 to a name and cpe label that it can use to look up the image in VEX
 statements.

See also release-engineering/rhtap-ec-policy#149

Based on original changes from @rbean in our other operator repos

Assisted-by: Gemini
---
 .tekton/build-pipeline.yaml           | 7 ++++++-
 .tekton/recert-4-20-pull-request.yaml | 3 +++
 .tekton/recert-4-20-push.yaml         | 3 +++
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/.tekton/build-pipeline.yaml b/.tekton/build-pipeline.yaml
index ce8ffa35..e82e614d 100644
--- a/.tekton/build-pipeline.yaml
+++ b/.tekton/build-pipeline.yaml
@@ -105,6 +105,10 @@ spec:
       default: docker
       type: string
       description: The format for the resulting image's mediaType. Valid values are oci or docker.
+    - default: []
+      description: Additional labels to apply to the built container image
+      name: additional-labels
+      type: array
   results:
     - description: ""
       name: IMAGE_URL
@@ -250,12 +254,13 @@ spec:
         - name: LABELS
           value:
             - $(tasks.generate-labels.results.labels[*])
+            - $(params.additional-labels[*])
             - com.redhat.component=recert
             - description=recert
             - distribution-scope=public
             - io.k8s.description=recert
-            - name=openshift4/recert-rhel9
             - release=4.20
+            - cpe="cpe:/a:redhat:openshift:4.20::el9"
             - url=https://github.com/rh-ecosystem-edge/recert
             - vendor=Red Hat, Inc.
             - io.k8s.display-name=recert
diff --git a/.tekton/recert-4-20-pull-request.yaml b/.tekton/recert-4-20-pull-request.yaml
index ded06c67..ca4d5ea8 100644
--- a/.tekton/recert-4-20-pull-request.yaml
+++ b/.tekton/recert-4-20-pull-request.yaml
@@ -70,6 +70,9 @@ spec:
       value: "true"
     - name: additional-tags
       value: []
+    - name: additional-labels
+      value:
+        - name=openshift4/recert-rhel9
   pipelineRef:
     name: build-pipeline
   taskRunTemplate:
diff --git a/.tekton/recert-4-20-push.yaml b/.tekton/recert-4-20-push.yaml
index 85483a52..d15a3dde 100644
--- a/.tekton/recert-4-20-push.yaml
+++ b/.tekton/recert-4-20-push.yaml
@@ -68,6 +68,9 @@ spec:
       value: "true"
     - name: additional-tags
       value: ["latest"]
+    - name: additional-labels
+      value:
+        - name=openshift4/recert-rhel9
   pipelineRef:
     name: build-pipeline
   taskRunTemplate: