diff --git a/.github/workflows/checks-codecov.yaml b/.github/workflows/checks-codecov.yaml index f5aeb70fb..11e6480f2 100644 --- a/.github/workflows/checks-codecov.yaml +++ b/.github/workflows/checks-codecov.yaml @@ -34,6 +34,7 @@ permissions: jobs: Test: + if: false # skipped for POC branch runs-on: ubuntu-latest steps: - name: Harden Runner @@ -96,6 +97,7 @@ jobs: retention-days: 1 Acceptance: + if: false # skipped for POC branch runs-on: ubuntu-latest steps: # Disabled until we figure out the "Could not resolve host: github.com" in @@ -164,6 +166,7 @@ jobs: Upload: name: "Upload Coverage Statistics" + if: false # skipped for POC branch runs-on: ubuntu-latest needs: [Test, Acceptance] steps: diff --git a/hack/create-dummy-its.sh b/hack/create-dummy-its.sh new file mode 100755 index 000000000..a92750a48 --- /dev/null +++ b/hack/create-dummy-its.sh @@ -0,0 +1,62 @@ +#!/usr/bin/env bash +# Copyright The Conforma Contributors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 + +set -euo pipefail + +NAMESPACE="${NAMESPACE:-rhtap-contract-tenant}" +APPLICATION="${APPLICATION:-ec-main}" +ITS_NAME="${ITS_NAME:-reqd-task-poc-ec2011}" + +GIT_URL="${GIT_URL:-https://github.com/simonbaird/conforma-cli}" +GIT_REVISION="${GIT_REVISION:-reqd-task-its-poc}" +PIPELINE_PATH="${PIPELINE_PATH:-pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml}" + +echo "Creating IntegrationTestScenario '${ITS_NAME}' in namespace '${NAMESPACE}'" +echo " Application: ${APPLICATION}" +echo " Git URL: ${GIT_URL}" +echo " Revision: ${GIT_REVISION}" +echo " Pipeline: ${PIPELINE_PATH}" +echo "" + +oc apply -f - <- + The desired result of the dummy check. Must be one of: SUCCESS, + FAILURE, WARNING, ERROR, or SKIPPED. + default: "SUCCESS" + results: + - name: TEST_OUTPUT + value: "$(tasks.dummy-check.results.TEST_OUTPUT)" + tasks: + - name: parse-snapshot + taskSpec: + params: + - name: SNAPSHOT + type: string + results: + - name: image-url + - name: image-digest + steps: + - name: parse + image: registry.access.redhat.com/ubi9/ubi-minimal:latest + env: + - name: SNAPSHOT + value: $(params.SNAPSHOT) + script: | + #!/usr/bin/env bash + set -euo pipefail + + IMAGE=$(echo "${SNAPSHOT}" | grep -oP '"containerImage"\s*:\s*"\K[^"]+' | head -1) + if [[ -z "${IMAGE}" ]]; then + echo "ERROR: No containerImage found in SNAPSHOT" >&2 + exit 1 + fi + + IMAGE_URL="${IMAGE%%@*}" + IMAGE_DIGEST="${IMAGE##*@}" + + echo "Parsed image-url: ${IMAGE_URL}" + echo "Parsed image-digest: ${IMAGE_DIGEST}" + + echo -n "${IMAGE_URL}" > "$(results.image-url.path)" + echo -n "${IMAGE_DIGEST}" > "$(results.image-digest.path)" + params: + - name: SNAPSHOT + value: "$(params.SNAPSHOT)" + - name: dummy-check + runAfter: + - parse-snapshot + params: + - name: RESULT + value: "$(params.RESULT)" + - name: image-url + value: "$(tasks.parse-snapshot.results.image-url)" + - name: image-digest + value: "$(tasks.parse-snapshot.results.image-digest)" + taskRef: + resolver: git + params: + - name: url + value: https://github.com/simonbaird/conforma-cli + - name: revision + value: reqd-task-its-poc + - name: pathInRepo + value: tasks/dummy-check/0.1/dummy-check.yaml diff --git a/tasks/dummy-check/0.1/dummy-check.yaml b/tasks/dummy-check/0.1/dummy-check.yaml new file mode 100644 index 000000000..611d1b588 --- /dev/null +++ b/tasks/dummy-check/0.1/dummy-check.yaml @@ -0,0 +1,169 @@ +# Copyright The Conforma Contributors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 + +--- +apiVersion: tekton.dev/v1 +kind: Task +metadata: + labels: + app.kubernetes.io/version: "0.1" + annotations: + tekton.dev/pipelines.minVersion: "0.12.1" + tekton.dev/tags: "konflux" + name: dummy-check +spec: + description: >- + A dummy task for testing purposes. Instead of performing a real check, it + produces a pass, fail, or warn result based on the RESULT param. Mimics the + output format of real SAST tasks (e.g. sast-snyk-check) so it can be used + as a stand-in during pipeline development and testing. + results: + - description: Tekton task test output. + name: TEST_OUTPUT + - name: TEST_OUTPUT_ARTIFACT_OUTPUTS + description: >- + JSON object with uri and digest referencing the pushed attestation. + Tekton Chains uses this for SLSA provenance. + type: object + properties: + uri: {} + digest: {} + params: + - name: RESULT + type: string + description: >- + The desired result of this dummy check. Must be one of: SUCCESS, + FAILURE, WARNING, ERROR, or SKIPPED. + default: "SUCCESS" + - name: NOTE + type: string + description: >- + Optional note to include in the test output. If not provided, a default + message is generated based on the RESULT value. + default: "" + - name: SUCCESSES + type: string + description: Number of successes to report in the test output. + default: "1" + - name: FAILURES + type: string + description: Number of failures to report in the test output. + default: "0" + - name: WARNINGS + type: string + description: Number of warnings to report in the test output. + default: "0" + - name: image-url + description: Image URL. + type: string + default: "" + - name: image-digest + description: Digest of the image. + type: string + default: "" + steps: + - name: dummy-check + results: + - name: TEST_OUTPUT + description: JSON test results for consumption by subsequent steps. + image: registry.access.redhat.com/ubi9/ubi-minimal:latest + env: + - name: RESULT + value: $(params.RESULT) + - name: NOTE + value: $(params.NOTE) + - name: SUCCESSES + value: $(params.SUCCESSES) + - name: FAILURES + value: $(params.FAILURES) + - name: WARNINGS + value: $(params.WARNINGS) + computeResources: + limits: + memory: 256Mi + requests: + cpu: 100m + memory: 128Mi + script: | + #!/usr/bin/env bash + set -euo pipefail + + VALID_RESULTS="SUCCESS FAILURE WARNING ERROR SKIPPED" + if ! echo "${VALID_RESULTS}" | grep -qw "${RESULT}"; then + echo "ERROR: Invalid RESULT '${RESULT}'. Must be one of: ${VALID_RESULTS}" >&2 + exit 1 + fi + + if [[ -z "${NOTE}" ]]; then + case "${RESULT}" in + SUCCESS) NOTE="Task $(context.task.name) completed successfully. This is a dummy check." ;; + FAILURE) NOTE="Task $(context.task.name) failed. This is a dummy check." ;; + WARNING) NOTE="Task $(context.task.name) produced warnings. This is a dummy check." ;; + ERROR) NOTE="Task $(context.task.name) encountered an error. This is a dummy check." ;; + SKIPPED) NOTE="Task $(context.task.name) was skipped. This is a dummy check." ;; + esac + fi + + # Adjust counts based on RESULT if user left defaults + case "${RESULT}" in + FAILURE) + if [[ "${FAILURES}" == "0" ]]; then FAILURES="1"; fi + if [[ "${SUCCESSES}" == "1" ]]; then SUCCESSES="0"; fi + ;; + WARNING) + if [[ "${WARNINGS}" == "0" ]]; then WARNINGS="1"; fi + ;; + ERROR|SKIPPED) + SUCCESSES="0" + FAILURES="0" + WARNINGS="0" + ;; + esac + + TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S") + + TEST_OUTPUT=$(printf '{ + "result": "%s", + "timestamp": "%s", + "note": "%s", + "namespace": "default", + "successes": %d, + "failures": %d, + "warnings": %d + }' "${RESULT}" "${TIMESTAMP}" "${NOTE}" "${SUCCESSES}" "${FAILURES}" "${WARNINGS}") + + echo "Dummy check result: ${RESULT}" + echo "${TEST_OUTPUT}" | tee "$(results.TEST_OUTPUT.path)" + echo -n "${TEST_OUTPUT}" > "$(step.results.TEST_OUTPUT.path)" + - name: create-test-result-attestation + ref: + resolver: git + params: + - name: url + value: https://github.com/simonbaird/step-actions + - name: revision + value: runner-image-fix + - name: pathInRepo + value: stepactions/attest-test-result/0.1/attest-test-result.yaml + params: + - name: image-url + value: $(params.image-url) + - name: image-digest + value: $(params.image-digest) + - name: test-name + value: $(context.task.name) + - name: test-output + value: $(steps.dummy-check.results.TEST_OUTPUT)