test-create-pyxis-image-mixed-helm-containers.yaml

---
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: test-create-pyxis-image-mixed-helm-containers
spec:
  description: |
    Run the create-pyxis-image task with a snapshot containing both Helm charts and container images.
    Verify that Helm charts are skipped and only container images are processed.
  params:
    - name: ociStorage
      description: The OCI repository where the Trusted Artifacts are stored.
      type: string
    - name: ociArtifactExpiresAfter
      description: Expiration date for the trusted artifacts created in the
        OCI repository. An empty string means the artifacts do not expire.
      type: string
      default: "1d"
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: "--insecure"
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable.
      type: string
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
  tasks:
    - name: setup
      taskSpec:
        results:
          - name: sourceDataArtifact
            type: string
        volumes:
          - name: workdir
            emptyDir: {}
        stepTemplate:
          volumeMounts:
            - mountPath: /var/workdir
              name: workdir
          env:
            - name: IMAGE_EXPIRES_AFTER
              value: $(params.ociArtifactExpiresAfter)
            - name: "ORAS_OPTIONS"
              value: "$(params.orasOptions)"
            - name: "DEBUG"
              value: "$(params.trustedArtifactsDebug)"
        steps:
          - name: setup-values
            image: quay.io/konflux-ci/release-service-utils:02a8ddcd16113371a255fd1ef0a196399d300162
            script: |
              #!/usr/bin/env bash
              set -eux

              mkdir -p "$(params.dataDir)/$(context.pipelineRun.uid)"
              cat > "$(params.dataDir)/$(context.pipelineRun.uid)/mydata.json" << EOF
              {
                "pyxis": {
                  "server": "stage",
                  "certified": false,
                  "secret": "pyxis"
                }
              }
              EOF

              cat > "$(params.dataDir)/$(context.pipelineRun.uid)/mapped_snapshot.json" << EOF
              {
                "application": "myapp",
                "components": [
                  {
                    "name": "web-frontend",
                    "containerImage": "registry.io/web-frontend@sha256:webdigest",
                    "repositories": [
                      {
                        "url": "registry.io/web-frontend",
                        "tags": ["1.0", "latest"]
                      }
                    ]
                  },
                  {
                    "name": "helm-chart",
                    "containerImage": "registry.io/helm-chart@sha256:helmdigest",
                    "repositories": [
                      {
                        "url": "registry.io/helm-chart",
                        "tags": ["1.0", "latest"]
                      }
                    ]
                  },
                  {
                    "name": "api-backend",
                    "containerImage": "registry.io/api-backend@sha256:apidigest",
                    "repositories": [
                      {
                        "url": "registry.io/api-backend",
                        "tags": ["1.0", "latest"]
                      }
                    ]
                  },
                  {
                    "name": "database",
                    "containerImage": "registry.io/database@sha256:dbdigest",
                    "repositories": [
                      {
                        "url": "registry.io/database",
                        "tags": ["1.0", "latest"]
                      }
                    ]
                  }
                ]
              }
              EOF
          - name: create-trusted-artifact
            ref:
              name: create-trusted-artifact
            params:
              - name: ociStorage
                value: $(params.ociStorage)
              - name: workDir
                value: $(params.dataDir)
              - name: sourceDataArtifact
                value: $(results.sourceDataArtifact.path)
    - name: run-task
      taskRef:
        name: create-pyxis-image
      params:
        - name: pyxisSecret
          value: test-create-pyxis-image-cert
        - name: server
          value: stage
        - name: snapshotPath
          value: $(context.pipelineRun.uid)/mapped_snapshot.json
        - name: dataPath
          value: $(context.pipelineRun.uid)/mydata.json
        - name: ociStorage
          value: $(params.ociStorage)
        - name: orasOptions
          value: $(params.orasOptions)
        - name: sourceDataArtifact
          value: "$(tasks.setup.results.sourceDataArtifact)=$(params.dataDir)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: $(params.trustedArtifactsDebug)
        - name: taskGitUrl
          value: "http://localhost"
        - name: taskGitRevision
          value: "main"
      runAfter:
        - setup
    - name: check-result
      params:
        - name: pyxisDataPath
          value: $(tasks.run-task.results.pyxisDataPath)
        - name: sourceDataArtifact
          value: "$(tasks.run-task.results.sourceDataArtifact)=$(params.dataDir)"
        - name: dataDir
          value: $(params.dataDir)
      taskSpec:
        params:
          - name: dataDir
            description: The location where data will be stored
            type: string
          - name: pyxisDataPath
            type: string
          - name: sourceDataArtifact
            type: string
        volumes:
          - name: workdir
            emptyDir: {}
        stepTemplate:
          volumeMounts:
            - mountPath: /var/workdir
              name: workdir
          env:
            - name: IMAGE_EXPIRES_AFTER
              value: $(params.ociArtifactExpiresAfter)
            - name: "ORAS_OPTIONS"
              value: "$(params.orasOptions)"
            - name: "DEBUG"
              value: "$(params.trustedArtifactsDebug)"
        steps:
          - name: use-trusted-artifact
            ref:
              name: use-trusted-artifact
            params:
              - name: workDir
                value: $(params.dataDir)
              - name: sourceDataArtifact
                value: $(params.sourceDataArtifact)
          - name: check-result
            image: quay.io/konflux-ci/release-service-utils:02a8ddcd16113371a255fd1ef0a196399d300162
            script: |
              #!/usr/bin/env bash
              set -eux

              # Verify pyxis.json structure
              pyxis_file="$(params.dataDir)/$(params.pyxisDataPath)"
              echo "Contents of pyxis.json:"
              cat "$pyxis_file"

              # Verify we have the expected number of components (3 containers, Helm chart filtered out)
              component_count=$(jq '.components | length' "$pyxis_file")
              if [ "$component_count" != "3" ]; then
                echo "Error: Expected 3 components in pyxis.json (only container images), but got $component_count"
                exit 1
              fi

              # Test downstream consumption pattern used by push-rpm-data-to-pyxis task
              if ! unique_images_result=$(jq '
                # This is the exact processing from push-rpm-data-to-pyxis.yaml line 132
                [.components[] as $c | $c.pyxisImages[] | {
                  imageId: .imageId,
                  containerImage: $c.containerImage,
                  pyxisImage: .
                }]' "$pyxis_file"); then
                echo "Error: Downstream consumption pattern failed"
                exit 1
              fi

              # Verify downstream processing produces expected results
              image_count=$(echo "$unique_images_result" | jq '. | length')
              if [ "$image_count" != "3" ]; then
                echo "Error: Expected 3 pyxis images from downstream processing, but got $image_count"
                exit 1
              fi

              echo "SUCCESS: Downstream consumption pattern works correctly"

              # Verify that all processed components are container images (not Helm charts)
              # by checking that each component has the expected containerImage field and pyxisImages
              processed_components=$(jq -r '.components[] | .containerImage' "$pyxis_file")

              # Verify we have the expected container images (but not the helm chart)
              if ! echo "$processed_components" | grep -q "web-frontend"; then
                echo Error: web-frontend container image should be processed
                exit 1
              fi

              if ! echo "$processed_components" | grep -q "api-backend"; then
                echo Error: api-backend container image should be processed
                exit 1
              fi

              if ! echo "$processed_components" | grep -q "database"; then
                echo Error: database container image should be processed
                exit 1
              fi

              # Verify helm-chart was NOT processed
              if echo "$processed_components" | grep -q "helm-chart"; then
                echo Error: helm-chart should NOT be processed \(should be skipped\)
                exit 1
              fi

              echo "SUCCESS: Mixed Helm + container images handled correctly"
              echo "  - Helm chart was skipped"
              echo "  - All 3 container images were processed"
              echo "  - Downstream consumption patterns work correctly"
      runAfter:
        - run-task