From 353a9afff2934b0a70235eb9d4afddedbf09798c Mon Sep 17 00:00:00 2001 From: Simon Baird Date: Fri, 7 Aug 2026 18:22:17 -0400 Subject: [PATCH 1/3] Add dummy task, pipeline, and ITS for EC-2011 Adds a dummy-check Tekton task that produces configurable pass/fail/warn results with a test-result attestation step, a pipeline that parses a Snapshot and runs the task, and a script to create the IntegrationTestScenario in the cluster. The goal is to dogfood the new method for required tasks to be run in ITS pipelines with their results visible to Conforma with a secure chain of trust. Ref: https://redhat.atlassian.net/browse/EC-2011 Co-Authored-By: Claude Opus 4.6 --- hack/create-dummy-its.sh | 62 +++++++ .../0.1/dummy-integration-test.yaml | 102 +++++++++++ tasks/dummy-check/0.1/dummy-check.yaml | 169 ++++++++++++++++++ 3 files changed, 333 insertions(+) create mode 100755 hack/create-dummy-its.sh create mode 100644 pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml create mode 100644 tasks/dummy-check/0.1/dummy-check.yaml diff --git a/hack/create-dummy-its.sh b/hack/create-dummy-its.sh new file mode 100755 index 000000000..a92750a48 --- /dev/null +++ b/hack/create-dummy-its.sh @@ -0,0 +1,62 @@ +#!/usr/bin/env bash +# Copyright The Conforma Contributors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 + +set -euo pipefail + +NAMESPACE="${NAMESPACE:-rhtap-contract-tenant}" +APPLICATION="${APPLICATION:-ec-main}" +ITS_NAME="${ITS_NAME:-reqd-task-poc-ec2011}" + +GIT_URL="${GIT_URL:-https://github.com/simonbaird/conforma-cli}" +GIT_REVISION="${GIT_REVISION:-reqd-task-its-poc}" +PIPELINE_PATH="${PIPELINE_PATH:-pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml}" + +echo "Creating IntegrationTestScenario '${ITS_NAME}' in namespace '${NAMESPACE}'" +echo " Application: ${APPLICATION}" +echo " Git URL: ${GIT_URL}" +echo " Revision: ${GIT_REVISION}" +echo " Pipeline: ${PIPELINE_PATH}" +echo "" + +oc apply -f - <- + The desired result of the dummy check. Must be one of: SUCCESS, + FAILURE, WARNING, ERROR, or SKIPPED. + default: "SUCCESS" + results: + - name: TEST_OUTPUT + value: "$(tasks.dummy-check.results.TEST_OUTPUT)" + tasks: + - name: parse-snapshot + taskSpec: + params: + - name: SNAPSHOT + type: string + results: + - name: image-url + - name: image-digest + steps: + - name: parse + image: registry.access.redhat.com/ubi9/ubi-minimal:latest + env: + - name: SNAPSHOT + value: $(params.SNAPSHOT) + script: | + #!/usr/bin/env bash + set -euo pipefail + + IMAGE=$(echo "${SNAPSHOT}" | grep -oP '"containerImage"\s*:\s*"\K[^"]+' | head -1) + if [[ -z "${IMAGE}" ]]; then + echo "ERROR: No containerImage found in SNAPSHOT" >&2 + exit 1 + fi + + IMAGE_URL="${IMAGE%%@*}" + IMAGE_DIGEST="${IMAGE##*@}" + + echo "Parsed image-url: ${IMAGE_URL}" + echo "Parsed image-digest: ${IMAGE_DIGEST}" + + echo -n "${IMAGE_URL}" > "$(results.image-url.path)" + echo -n "${IMAGE_DIGEST}" > "$(results.image-digest.path)" + params: + - name: SNAPSHOT + value: "$(params.SNAPSHOT)" + - name: dummy-check + runAfter: + - parse-snapshot + params: + - name: RESULT + value: "$(params.RESULT)" + - name: image-url + value: "$(tasks.parse-snapshot.results.image-url)" + - name: image-digest + value: "$(tasks.parse-snapshot.results.image-digest)" + taskRef: + resolver: git + params: + - name: url + value: https://github.com/simonbaird/conforma-cli + - name: revision + value: reqd-task-its-poc + - name: pathInRepo + value: tasks/dummy-check/0.1/dummy-check.yaml diff --git a/tasks/dummy-check/0.1/dummy-check.yaml b/tasks/dummy-check/0.1/dummy-check.yaml new file mode 100644 index 000000000..5b473c4c7 --- /dev/null +++ b/tasks/dummy-check/0.1/dummy-check.yaml @@ -0,0 +1,169 @@ +# Copyright The Conforma Contributors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 + +--- +apiVersion: tekton.dev/v1 +kind: Task +metadata: + labels: + app.kubernetes.io/version: "0.1" + annotations: + tekton.dev/pipelines.minVersion: "0.12.1" + tekton.dev/tags: "konflux" + name: dummy-check +spec: + description: >- + A dummy task for testing purposes. Instead of performing a real check, it + produces a pass, fail, or warn result based on the RESULT param. Mimics the + output format of real SAST tasks (e.g. sast-snyk-check) so it can be used + as a stand-in during pipeline development and testing. + results: + - description: Tekton task test output. + name: TEST_OUTPUT + - name: TEST_OUTPUT_ARTIFACT_OUTPUTS + description: >- + JSON object with uri and digest referencing the pushed attestation. + Tekton Chains uses this for SLSA provenance. + type: object + properties: + uri: {} + digest: {} + params: + - name: RESULT + type: string + description: >- + The desired result of this dummy check. Must be one of: SUCCESS, + FAILURE, WARNING, ERROR, or SKIPPED. + default: "SUCCESS" + - name: NOTE + type: string + description: >- + Optional note to include in the test output. If not provided, a default + message is generated based on the RESULT value. + default: "" + - name: SUCCESSES + type: string + description: Number of successes to report in the test output. + default: "1" + - name: FAILURES + type: string + description: Number of failures to report in the test output. + default: "0" + - name: WARNINGS + type: string + description: Number of warnings to report in the test output. + default: "0" + - name: image-url + description: Image URL. + type: string + default: "" + - name: image-digest + description: Digest of the image. + type: string + default: "" + steps: + - name: dummy-check + results: + - name: TEST_OUTPUT + description: JSON test results for consumption by subsequent steps. + image: registry.access.redhat.com/ubi9/ubi-minimal:latest + env: + - name: RESULT + value: $(params.RESULT) + - name: NOTE + value: $(params.NOTE) + - name: SUCCESSES + value: $(params.SUCCESSES) + - name: FAILURES + value: $(params.FAILURES) + - name: WARNINGS + value: $(params.WARNINGS) + computeResources: + limits: + memory: 256Mi + requests: + cpu: 100m + memory: 128Mi + script: | + #!/usr/bin/env bash + set -euo pipefail + + VALID_RESULTS="SUCCESS FAILURE WARNING ERROR SKIPPED" + if ! echo "${VALID_RESULTS}" | grep -qw "${RESULT}"; then + echo "ERROR: Invalid RESULT '${RESULT}'. Must be one of: ${VALID_RESULTS}" >&2 + exit 1 + fi + + if [[ -z "${NOTE}" ]]; then + case "${RESULT}" in + SUCCESS) NOTE="Task $(context.task.name) completed successfully. This is a dummy check." ;; + FAILURE) NOTE="Task $(context.task.name) failed. This is a dummy check." ;; + WARNING) NOTE="Task $(context.task.name) produced warnings. This is a dummy check." ;; + ERROR) NOTE="Task $(context.task.name) encountered an error. This is a dummy check." ;; + SKIPPED) NOTE="Task $(context.task.name) was skipped. This is a dummy check." ;; + esac + fi + + # Adjust counts based on RESULT if user left defaults + case "${RESULT}" in + FAILURE) + if [[ "${FAILURES}" == "0" ]]; then FAILURES="1"; fi + if [[ "${SUCCESSES}" == "1" ]]; then SUCCESSES="0"; fi + ;; + WARNING) + if [[ "${WARNINGS}" == "0" ]]; then WARNINGS="1"; fi + ;; + ERROR|SKIPPED) + SUCCESSES="0" + FAILURES="0" + WARNINGS="0" + ;; + esac + + TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S") + + TEST_OUTPUT=$(printf '{ + "result": "%s", + "timestamp": "%s", + "note": "%s", + "namespace": "default", + "successes": %d, + "failures": %d, + "warnings": %d + }' "${RESULT}" "${TIMESTAMP}" "${NOTE}" "${SUCCESSES}" "${FAILURES}" "${WARNINGS}") + + echo "Dummy check result: ${RESULT}" + echo "${TEST_OUTPUT}" | tee "$(results.TEST_OUTPUT.path)" + echo -n "${TEST_OUTPUT}" > "$(step.results.TEST_OUTPUT.path)" + - name: create-test-result-attestation + ref: + resolver: git + params: + - name: url + value: https://github.com/conforma/step-actions + - name: revision + value: main + - name: pathInRepo + value: stepactions/attest-test-result/0.1/attest-test-result.yaml + params: + - name: image-url + value: $(params.image-url) + - name: image-digest + value: $(params.image-digest) + - name: test-name + value: $(context.task.name) + - name: test-output + value: $(steps.dummy-check.results.TEST_OUTPUT) From 4830e008e54b809d86900def8459af48598fdaea Mon Sep 17 00:00:00 2001 From: Simon Baird Date: Fri, 7 Aug 2026 18:45:36 -0400 Subject: [PATCH 2/3] DNM: Skip CI test jobs for POC branch Co-Authored-By: Claude Opus 4.6 --- .github/workflows/checks-codecov.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/checks-codecov.yaml b/.github/workflows/checks-codecov.yaml index f5aeb70fb..11e6480f2 100644 --- a/.github/workflows/checks-codecov.yaml +++ b/.github/workflows/checks-codecov.yaml @@ -34,6 +34,7 @@ permissions: jobs: Test: + if: false # skipped for POC branch runs-on: ubuntu-latest steps: - name: Harden Runner @@ -96,6 +97,7 @@ jobs: retention-days: 1 Acceptance: + if: false # skipped for POC branch runs-on: ubuntu-latest steps: # Disabled until we figure out the "Could not resolve host: github.com" in @@ -164,6 +166,7 @@ jobs: Upload: name: "Upload Coverage Statistics" + if: false # skipped for POC branch runs-on: ubuntu-latest needs: [Test, Acceptance] steps: From 1544e2f46cead023283db93b35213e14e17f738e Mon Sep 17 00:00:00 2001 From: Simon Baird Date: Fri, 7 Aug 2026 22:12:10 -0400 Subject: [PATCH 3/3] Point step action at fork with working image Co-Authored-By: Claude Opus 4.6 --- tasks/dummy-check/0.1/dummy-check.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tasks/dummy-check/0.1/dummy-check.yaml b/tasks/dummy-check/0.1/dummy-check.yaml index 5b473c4c7..611d1b588 100644 --- a/tasks/dummy-check/0.1/dummy-check.yaml +++ b/tasks/dummy-check/0.1/dummy-check.yaml @@ -153,9 +153,9 @@ spec: resolver: git params: - name: url - value: https://github.com/conforma/step-actions + value: https://github.com/simonbaird/step-actions - name: revision - value: main + value: runner-image-fix - name: pathInRepo value: stepactions/attest-test-result/0.1/attest-test-result.yaml params: