[DNM] Add roxctl-scan task to pull request pipeline #3470
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -579,6 +579,28 @@ spec: | |
| operator: in | ||
| values: | ||
| - "false" | ||
| - name: roxctl-scan | ||
| params: | ||
| - name: image-url | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| - name: image-digest | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: url | ||
| value: https://github.com/cuipinghuo/konflux-test-tasks | ||
|
There was a problem hiding this comment. [medium] Description-Diff Mismatch The PR body claims the task is 'Resolved via Tekton bundle at quay.io/konflux-ci/tekton-catalog/task-roxctl-scan:0.1 with pinned digest', but the actual diff uses resolver: git pointing to https://github.com/cuipinghuo/konflux-test-tasks on a feature branch. This mismatch could mislead reviewers into believing the task follows the established pinned-bundle pattern. Suggested fix: Update the PR description to accurately reflect that the implementation uses a git resolver to a personal fork, not a bundle resolver with pinned digest. |
||
| - name: revision | ||
| value: stoneintg-1755-fix-roxctl-oci-attach | ||
| - name: pathInRepo | ||
| value: task/roxctl-scan/0.1/roxctl-scan.yaml | ||
| resolver: git | ||
| when: | ||
| - input: $(params.skip-checks) | ||
| operator: in | ||
| values: | ||
| - "false" | ||
| workspaces: | ||
| - name: git-auth | ||
| optional: true | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[critical] Supply Chain Integrity
The new roxctl-scan task uses a git resolver pointing to a personal GitHub repository (https://github.com/cuipinghuo/konflux-test-tasks) on a mutable feature branch (stoneintg-1755-fix-roxctl-oci-attach), whereas every other task in this pipeline (17 total) uses the bundles resolver with SHA256 digest-pinned references from quay.io/konflux-ci/tekton-catalog/. This introduces supply chain risks: (1) task definition fetched from a personal fork rather than an official catalog, (2) mutable branch reference that can be force-pushed or deleted, (3) weaker access controls on personal repo, (4) task executes in CI pipeline security context with access to secrets and workspaces. While the PR is draft/DNM, these risks are real if the PR is merged as-is or if someone copies this pattern.
Suggested fix: Use the bundles resolver with a SHA256 digest-pinned reference from the official quay.io/konflux-ci/tekton-catalog/ registry. If the task is not yet available in the catalog, keep the PR blocked until published, or at minimum pin to a specific commit SHA in the git resolver rather than a branch name.