apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: push-pipeline
  labels:
    appstudio.openshift.io/application: ramalama
spec:
  description: |
    Pipeline for building RamaLama images on push.
    Based on the [docker-build-multi-platform-oci-ta](https://github.com/konflux-ci/build-definitions/tree/main/pipelines/docker-build-multi-platform-oci-ta) pipeline from [Konflux](https://konflux-ci.dev/).
  params:
  - description: Source Repository URL
    name: git-url
    type: string
  - default: ""
    description: Revision of the Source Repository
    name: revision
    type: string
  - description: Fully Qualified Output Image
    name: output-image
    type: string
  - default: .
    description: Path to the source code of an application's component from where to build image.
    name: path-context
    type: string
  - default: Dockerfile
    description: Path to the Dockerfile inside the context specified by parameter path-context
    name: dockerfile
    type: string
  - default: "false"
    description: Force rebuild image
    name: rebuild
    type: string
  - default: "false"
    description: Skip checks against built image
    name: skip-checks
    type: string
  - default: "false"
    description: Execute the build with network isolation
    name: hermetic
    type: string
  - default: ""
    description: Build dependencies to be prefetched by Cachi2
    name: prefetch-input
    type: string
  - default: ""
    description: Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.
    name: image-expires-after
  - default: "false"
    description: Build a source image.
    name: build-source-image
    type: string
  - default: "true"
    description: Add built image into an OCI image index
    name: build-image-index
    type: string
  - default: []
    description: Array of --build-arg values ("arg=value" strings) for buildah
    name: build-args
    type: array
  - default: ""
    description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file
    name: build-args-file
    type: string
  - default: "false"
    description: Whether to enable privileged mode, should be used only with remote VMs
    name: privileged-nested
    type: string
  - default:
    - linux-d160-c8xlarge/amd64
    - linux-d160-c8xlarge/arm64
    description: List of platforms to build the container images on. The available set of values is determined by the configuration of the multi-platform-controller.
    name: build-platforms
    type: array
  - default: ""
    description: The parent image of the image being built.
    name: parent-image
  - default: ""
    description: The image to use for running tests.
    name: test-image
  - default: []
    description: List of environment variables (NAME=VALUE) to be set in the test environment.
    name: test-envs
    type: array
  - default:
    - echo "No tests defined"
    description: List of test commands to run after the image is built.
    name: test-commands
    type: array
  - name: buildah-format
    default: docker
    type: string
    description: The format for the resulting image's mediaType. Valid values are oci or docker.
  results:
  - description: ""
    name: IMAGE_URL
    value: $(tasks.build-image-index.results.IMAGE_URL)
  - description: ""
    name: IMAGE_DIGEST
    value: $(tasks.build-image-index.results.IMAGE_DIGEST)
  - description: ""
    name: CHAINS-GIT_URL
    value: $(tasks.clone-repository.results.url)
  - description: ""
    name: CHAINS-GIT_COMMIT
    value: $(tasks.clone-repository.results.commit)
  tasks:
  - name: init
    params:
    - name: image-url
      value: $(params.output-image)
    - name: rebuild
      value: $(params.rebuild)
    - name: skip-checks
      value: $(params.skip-checks)
    taskRef:
      params:
      - name: name
        value: init
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:4072de81ade0a75ad1eaa5449a7ff02bba84757064549a81b48c28fab3aeca59
      - name: kind
        value: task
      resolver: bundles
  - name: clone-repository
    params:
    - name: url
      value: $(params.git-url)
    - name: revision
      value: $(params.revision)
    - name: ociStorage
      value: $(params.output-image).git
    - name: ociArtifactExpiresAfter
      value: $(params.image-expires-after)
    runAfter:
    - init
    taskRef:
      params:
      - name: name
        value: git-clone-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:ea64f5b99202621e78ed3d74b00df5750cbf572c391e6da1956396f5945e4e11
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(tasks.init.results.build)
      operator: in
      values:
      - "true"
    workspaces:
    - name: basic-auth
      workspace: git-auth
  - name: prefetch-dependencies
    params:
    - name: input
      value: $(params.prefetch-input)
    - name: SOURCE_ARTIFACT
      value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
    - name: ociStorage
      value: $(params.output-image).prefetch
    - name: ociArtifactExpiresAfter
      value: $(params.image-expires-after)
    runAfter:
    - clone-repository
    taskRef:
      params:
      - name: name
        value: prefetch-dependencies-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.2@sha256:3fa0204a481044b21f0e784ce39cbd25e8fb49c664a5458f3eef351fff1c906e
      - name: kind
        value: task
      resolver: bundles
    workspaces:
    - name: git-basic-auth
      workspace: git-auth
    - name: netrc
      workspace: netrc
  - name: wait-for-parent-image
    params:
    - name: ref
      value: $(params.parent-image)
    taskRef:
      name: wait-for-image
    timeout: 10h
    when:
    - input: $(params.parent-image)
      operator: notin
      values:
      - ""
  - matrix:
      params:
      - name: PLATFORM
        value:
        - $(params.build-platforms)
    name: build-images
    params:
    - name: IMAGE
      value: $(params.output-image)
    - name: DOCKERFILE
      value: $(params.dockerfile)
    - name: CONTEXT
      value: $(params.path-context)
    - name: HERMETIC
      value: $(params.hermetic)
    - name: PREFETCH_INPUT
      value: $(params.prefetch-input)
    - name: IMAGE_EXPIRES_AFTER
      value: $(params.image-expires-after)
    - name: COMMIT_SHA
      value: $(tasks.clone-repository.results.commit)
    - name: BUILD_ARGS
      value:
      - $(params.build-args[*])
    - name: BUILD_ARGS_FILE
      value: $(params.build-args-file)
    - name: PRIVILEGED_NESTED
      value: $(params.privileged-nested)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    - name: CACHI2_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
    - name: IMAGE_APPEND_PLATFORM
      value: "true"
    - name: BUILDAH_FORMAT
      value: $(params.buildah-format)
    runAfter:
    - wait-for-parent-image
    - prefetch-dependencies
    taskRef:
      params:
      - name: name
        value: buildah-remote-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.7@sha256:ee5e01eb59a3f70bb1012950fbc4081bac96d3f3517e6d204314484cd2e0059b
      - name: kind
        value: task
      resolver: bundles
    timeout: 10h
    when:
    - input: $(tasks.init.results.build)
      operator: in
      values:
      - "true"
  - name: build-image-index
    params:
    - name: IMAGE
      value: $(params.output-image)
    - name: COMMIT_SHA
      value: $(tasks.clone-repository.results.commit)
    - name: IMAGE_EXPIRES_AFTER
      value: $(params.image-expires-after)
    - name: ALWAYS_BUILD_INDEX
      value: $(params.build-image-index)
    - name: IMAGES
      value:
      - $(tasks.build-images.results.IMAGE_REF[*])
    - name: BUILDAH_FORMAT
      value: $(params.buildah-format)
    runAfter:
    - build-images
    taskRef:
      params:
      - name: name
        value: build-image-index
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.2@sha256:803ae1ecf35bc5d22be9882819e942e4b699cb17655055afc6bb6b02d34cfab8
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(tasks.init.results.build)
      operator: in
      values:
      - "true"
  - name: wait-for-test-image
    params:
    - name: ref
      value: $(params.test-image)
    runAfter:
    - build-image-index
    taskRef:
      name: wait-for-image
    when:
    - input: $(params.test-image)
      operator: notin
      values:
      - ""
  - name: run-tests
    matrix:
      params:
      - name: cmd
        value:
        - $(params.test-commands)
    params:
    - name: image
      value: $(params.test-image)@$(tasks.wait-for-test-image.results.digest)
    - name: envs
      value:
      - $(params.test-envs[*])
    runAfter:
    - wait-for-test-image
    taskRef:
      name: test-cmd
    when:
    - input: $(params.test-image)
      operator: notin
      values:
      - ""
  - name: build-source-image
    params:
    - name: BINARY_IMAGE
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    - name: CACHI2_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
    - name: BINARY_IMAGE_DIGEST
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: source-build-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:4abb2dbc9dcfad52d56b490a2f25f99989a2cb2bbd9881223025272db60fd75e
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(tasks.init.results.build)
      operator: in
      values:
      - "true"
    - input: $(params.build-source-image)
      operator: in
      values:
      - "true"
  - name: deprecated-base-image-check
    params:
    - name: IMAGE_URL
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: IMAGE_DIGEST
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: deprecated-image-check
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:462baed733dfc38aca5395499e92f19b6f13a74c2e88fe5d86c3cffa2f899b57
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - matrix:
      params:
      - name: image-platform
        value:
        - $(params.build-platforms)
    name: clair-scan
    params:
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: clair-scan
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:8ec7d7b9438ace5ef3fb03a533d9440d0fd81e51c73b0dc1eb51602fb7cd044e
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: sast-snyk-check
    params:
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    - name: CACHI2_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: sast-snyk-check-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8ad28b7783837a24acbc9a8494c935e796e591ce476085ad5899bebd7e53f077
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - matrix:
      params:
      - name: image-arch
        value:
        - $(params.build-platforms)
    name: clamav-scan
    params:
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: clamav-scan
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:f3d2d179cddcc07d0228d9f52959a233037a3afa2619d0a8b2effbb467db80c3
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: sast-coverity-check
    params:
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: IMAGE
      value: $(params.output-image)
    - name: DOCKERFILE
      value: $(params.dockerfile)
    - name: CONTEXT
      value: $(params.path-context)
    - name: HERMETIC
      value: $(params.hermetic)
    - name: PREFETCH_INPUT
      value: $(params.prefetch-input)
    - name: IMAGE_EXPIRES_AFTER
      value: $(params.image-expires-after)
    - name: COMMIT_SHA
      value: $(tasks.clone-repository.results.commit)
    - name: BUILD_ARGS
      value:
      - $(params.build-args[*])
    - name: BUILD_ARGS_FILE
      value: $(params.build-args-file)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    - name: CACHI2_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
    runAfter:
    - coverity-availability-check
    taskRef:
      params:
      - name: name
        value: sast-coverity-check-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.3@sha256:78f5244a8cfd28c890ed62db7e4ff1fc97ff39876d37fb19f1b0c2c286a4002c
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
    - input: $(tasks.coverity-availability-check.results.STATUS)
      operator: in
      values:
      - success
  - name: coverity-availability-check
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: coverity-availability-check
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:36400873d3031df128c55aa71ee11d322c3e55fd8f13dc5779098fbc117c0aa3
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: sast-shell-check
    params:
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    - name: CACHI2_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: sast-shell-check-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:d44336d7bcbd1f7cedee639357a493bd1f661e2859e49e11a34644bdf6819c4e
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: sast-unicode-check
    params:
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    - name: CACHI2_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: sast-unicode-check-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.3@sha256:e5a8d3e8e7be7246a1460385b95c084ea6e8fe7520d40fe4389deb90f1bf5176
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  - name: apply-tags
    params:
    - name: IMAGE_URL
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: IMAGE_DIGEST
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: apply-tags
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.2@sha256:a61d8a6d0ba804869e8fe57a9289161817afad379ef2d7433d75ae40a148e2ec
      - name: kind
        value: task
      resolver: bundles
  - name: push-dockerfile
    params:
    - name: IMAGE
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: IMAGE_DIGEST
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - name: DOCKERFILE
      value: $(params.dockerfile)
    - name: CONTEXT
      value: $(params.path-context)
    - name: SOURCE_ARTIFACT
      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: push-dockerfile-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:08bba4a659ecd48f871bef00b80af58954e5a09fcbb28a1783ddd640c4f6535e
      - name: kind
        value: task
      resolver: bundles
  - name: rpms-signature-scan
    params:
    - name: image-url
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - name: image-digest
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    runAfter:
    - build-image-index
    taskRef:
      params:
      - name: name
        value: rpms-signature-scan
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:13cf619a8c24e5a565f1b3f20f6998273d3108a2866e04076b6f0dd967251af3
      - name: kind
        value: task
      resolver: bundles
    when:
    - input: $(params.skip-checks)
      operator: in
      values:
      - "false"
  finally:
  - name: show-sbom
    params:
    - name: IMAGE_URL
      value: $(tasks.build-image-index.results.IMAGE_URL)
    taskRef:
      params:
      - name: name
        value: show-sbom
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:beb0616db051952b4b861dd8c3e00fa1c0eccbd926feddf71194d3bb3ace9ce7
      - name: kind
        value: task
      resolver: bundles
  workspaces:
  - name: git-auth
    optional: true
  - name: netrc
    optional: true
