Update Konflux references - #1904
Conversation
red-hat-konflux
Bot
added
approved
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
1 similar comment
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe pull request updates Tekton pipeline bundles and digests. It adds reproducible image-build parameters and lifecycle artifact injection to FBC pipelines. It removes obsolete ChangesTekton pipeline updates
Estimated code review effort: 3 (Moderate) | ~25 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
ee00563 to
1dbc238
Compare
1dbc238 to
0dcd67d
Compare
|
/retitle rebase! Update Konflux references |
openshift-ci
Bot
changed the title
0dcd67d to
24f706a
Compare
red-hat-konflux
Bot
changed the title
|
/retitle rebase! Update Konflux references |
openshift-ci
Bot
changed the title
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
24f706a to
2f89b82
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
red-hat-konflux
Bot
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.tekton/fbc-v4-16-pull-request.yaml:
- Around line 245-250: Update the SOURCE_DATE_EPOCH environment variable in all
nine listed pipelines—.tekton/fbc-v4-16-pull-request.yaml (245-250),
.tekton/fbc-v4-16-push.yaml (232-237), .tekton/fbc-v4-17-pull-request.yaml
(235-240), .tekton/fbc-v4-17-push.yaml (232-237),
.tekton/fbc-v4-22-pull-request.yaml (260-265), .tekton/fbc-v4-22-push.yaml
(257-262), .tekton/lightspeed-operator-push.yaml (235-240),
.tekton/ols-bundle-push.yaml (238-243), and
.tekton/lightspeed-operator-pull-request.yaml (238-243)—to use the
clone-repository commit-timestamp result when source-date-epoch is empty, while
preserving any explicitly supplied epoch.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: e07936b4-b098-43aa-bc41-ea06f19e90e4
📒 Files selected for processing (18)
.tekton/fbc-v4-16-pull-request.yaml.tekton/fbc-v4-16-push.yaml.tekton/fbc-v4-17-pull-request.yaml.tekton/fbc-v4-17-push.yaml.tekton/fbc-v4-18-pull-request.yaml.tekton/fbc-v4-18-push.yaml.tekton/fbc-v4-19-pull-request.yaml.tekton/fbc-v4-19-push.yaml.tekton/fbc-v4-20-pull-request.yaml.tekton/fbc-v4-20-push.yaml.tekton/fbc-v4-21-pull-request.yaml.tekton/fbc-v4-21-push.yaml.tekton/fbc-v4-22-pull-request.yaml.tekton/fbc-v4-22-push.yaml.tekton/lightspeed-operator-pull-request.yaml.tekton/lightspeed-operator-push.yaml.tekton/ols-bundle-pull-request.yaml.tekton/ols-bundle-push.yaml
| - name: SOURCE_DATE_EPOCH | ||
| value: $(params.source-date-epoch) | ||
| - name: REWRITE_TIMESTAMP | ||
| value: $(params.rewrite-timestamp) | ||
| - name: OMIT_HISTORY | ||
| value: $(params.omit-history) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
files=(
.tekton/fbc-v4-16-pull-request.yaml
.tekton/fbc-v4-16-push.yaml
.tekton/fbc-v4-17-pull-request.yaml
.tekton/fbc-v4-17-push.yaml
.tekton/fbc-v4-22-pull-request.yaml
.tekton/fbc-v4-22-push.yaml
.tekton/lightspeed-operator-push.yaml
.tekton/ols-bundle-push.yaml
.tekton/lightspeed-operator-pull-request.yaml
)
for file in "${files[@]}"; do
echo "=== ${file} ==="
rg -n -C 2 'commit-timestamp|source-date-epoch|rewrite-timestamp|SOURCE_DATE_EPOCH' "$file"
doneRepository: openshift/lightspeed-operator
Length of output: 10164
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
files=(
.tekton/fbc-v4-16-pull-request.yaml
.tekton/fbc-v4-16-push.yaml
.tekton/fbc-v4-17-pull-request.yaml
.tekton/fbc-v4-17-push.yaml
.tekton/fbc-v4-22-pull-request.yaml
.tekton/fbc-v4-22-push.yaml
.tekton/lightspeed-operator-push.yaml
.tekton/ols-bundle-push.yaml
.tekton/lightspeed-operator-pull-request.yaml
)
for file in "${files[@]}"; do
echo "=== ${file} ==="
rg -n -C 5 'clone-repository|commit-timestamp|source-date-epoch|rewrite-timestamp|SOURCE_DATE_EPOCH|REWRITE_TIMESTAMP' "$file"
doneRepository: openshift/lightspeed-operator
Length of output: 33199
🌐 Web query:
Konflux ADR 0069 reproducible container builds source-date-epoch clone-repository commit-timestamp rewrite-timestamp fallback
💡 Result:
Konflux ADR 0069 outlines the strategy for achieving reproducible container builds within the Konflux CI system, addressing the issue where identical git commits produce different image digests [1][2]. To achieve bit-wise reproducibility, the architecture leverages specific configuration parameters that control how timestamps are handled during the build process [3]: 1. SOURCE_DATE_EPOCH: This parameter is used to define a deterministic timestamp for the container build [4][5]. It is recommended to populate this using the commit-timestamp result from the clone-repository task [3][6]. Setting this variable ensures that the image's "Created" metadata field is consistent [3]. 2. rewrite-timestamp: This parameter acts as a critical companion to SOURCE_DATE_EPOCH [3]. While setting the epoch fixes image metadata, it does not automatically modify the modification times (mtime) of individual files within the image layers [3]. Enabling rewrite-timestamp (typically by setting it to "true") instructs the build tool to clamp the mtime of all files within the layers to at most the provided SOURCE_DATE_EPOCH [4][5]. As noted in build definitions, these parameters are designed to work together to ensure that file modification times and image metadata are consistent across rebuilds, which is required for stable, deterministic image digests [3][4]. Users should be aware that buildah (a common engine used in these pipelines) treats --timestamp and --source-date-epoch as mutually exclusive, and the pipeline logic must be configured to correctly propagate these values without conflict [3][4][5]. Beyond these build parameters, ADR 0069 also proposes a verification-side approach involving an on-demand pipeline that rebuilds images from source and compares digests using SLSA verification summaries to confirm reproducibility [2].
Citations:
- 1: https://konflux-ci.dev/architecture/ADR/0069-reproducible-container-builds/
- 2: Add ADR-0069: Reproducible Container Builds in Konflux konflux-ci/architecture#360
- 3: Use commit-timestamp in tasks in pursuit of reproducible builds konflux-ci/build-definitions#1268
- 4: https://github.com/konflux-ci/build-definitions/blob/main/pipelines/docker-build/README.md
- 5: https://github.com/konflux-ci/build-definitions/blob/main/pipelines/fbc-builder/README.md
- 6: https://konflux-ci.dev/docs/patterns/mapping-tags-to-labels/
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
urls=(
https://konflux-ci.dev/architecture/ADR/0069-reproducible-container-builds/
https://raw.githubusercontent.com/konflux-ci/build-definitions/main/pipelines/fbc-builder/README.md
https://raw.githubusercontent.com/konflux-ci/build-definitions/main/pipelines/docker-build/README.md
)
for url in "${urls[@]}"; do
echo "=== ${url} ==="
curl -LfsS --max-time 20 "$url" |
rg -n -i -C 4 'commit-timestamp|source.date.epoch|SOURCE_DATE_EPOCH|rewrite.timestamp|REWRITE_TIMESTAMP|fallback' || true
doneRepository: openshift/lightspeed-operator
Length of output: 34195
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for file in .tekton/*.yaml; do
rg -n -H -C 3 'name: clone-repository|commit-timestamp|value: .*clone-repository.*results' "$file" || true
doneRepository: openshift/lightspeed-operator
Length of output: 40556
Wire the empty epoch case to the clone timestamp.
When rewrite-timestamp is true and source-date-epoch is empty, pass $(tasks.clone-repository.results.commit-timestamp) as SOURCE_DATE_EPOCH. Preserve an explicitly supplied epoch. Without this fallback, REWRITE_TIMESTAMP does nothing.
Apply this to all nine listed pipelines.
📍 Affects 9 files
.tekton/fbc-v4-16-pull-request.yaml#L245-L250(this comment).tekton/fbc-v4-16-push.yaml#L232-L237.tekton/fbc-v4-17-pull-request.yaml#L235-L240.tekton/fbc-v4-17-push.yaml#L232-L237.tekton/fbc-v4-22-pull-request.yaml#L260-L265.tekton/fbc-v4-22-push.yaml#L257-L262.tekton/lightspeed-operator-push.yaml#L235-L240.tekton/ols-bundle-push.yaml#L238-L243.tekton/lightspeed-operator-pull-request.yaml#L238-L243
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.tekton/fbc-v4-16-pull-request.yaml around lines 245 - 250, Update the
SOURCE_DATE_EPOCH environment variable in all nine listed
pipelines—.tekton/fbc-v4-16-pull-request.yaml (245-250),
.tekton/fbc-v4-16-push.yaml (232-237), .tekton/fbc-v4-17-pull-request.yaml
(235-240), .tekton/fbc-v4-17-push.yaml (232-237),
.tekton/fbc-v4-22-pull-request.yaml (260-265), .tekton/fbc-v4-22-push.yaml
(257-262), .tekton/lightspeed-operator-push.yaml (235-240),
.tekton/ols-bundle-push.yaml (238-243), and
.tekton/lightspeed-operator-pull-request.yaml (238-243)—to use the
clone-repository commit-timestamp result when source-date-epoch is empty, while
preserving any explicitly supplied epoch.
|
/lgtm |
|
@red-hat-konflux: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
This PR contains the following updates:
3ab8441→da0cff20.3→0.3.10.10→0.11.00.3→0.3.20.3→0.3.1e78d0d3→0ccc6882e5ebe0→e438f31935adb6→11f4ade0.2→0.2.50.4→0.4.30.3→0.7.00.3→0.3.10.2→0.2.1f6a115e→d33d800918327b→f4818f84961c44→f31055c0.1→0.37c5575a→93f1df10.1→0.3Release Notes
konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-build-image-index)
v0.3.1Fixed
SBOM_SKIP_VALIDATIONinto the step environment so the create-sbom step honors the parameter.The parameter did nothing before. Now it works as expected.
konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)
v0.11.0Changed
a directory instead of scanning the the image as an OCI archive. This improves
the scanning time, disk usage and may improve memory usage. More details in
konflux-build-cli/docs/design/syft-image-scanning.md.
from the build VM instead of rsyncing the image back to the cluster first.
For large images, this significantly reduces the time spent on network transfers.
Removed
sbom-syft-generatestep, SBOM generation now happensin the
buildstep.pushstep, the push now happens in thebuildstep.the pipeline will fail with
invalid StepOverride. See the migration guidance below.Migration guidance
Buildah v0.11.0 comes with a migration script that will attempt to automatically
fix the step overrides in your PipelineRuns. In most cases, no manual action will
be needed. But there are cases that the script cannot handle:
script will never get a chance to run on the PipelineRun.
than the build itself and the remote VMs do not have sufficient resources.
If the migration script doesn't solve the problem, please follow the procedure below.
Manual procedure
If you have
sbom-syft-generateorpushstep overrides in the.spec.taskRunSpecssection in your PipelineRun, please remove them. In most cases, this should be all.
However, if you were previously requesting more resources for SBOM generation
than for the build step itself, there is a chance that the build will fail.
In this case, move the relevant overrides to the build step. The same technically
applies for the push step, but it's highly unlikely that pushing would require
more resources than the build.
For example:
spec: taskRunSpecs: - pipelineTaskName: build-container stepSpecs: - - name: sbom-syft-generate + - name: build computeResources: requests: memory: 16Gi limits: memory: 16GiThis will work for build steps that run in-cluster - single-platform builds
and typically also the amd64 builds in a multi-platform build setup.
For build steps that run on remote VMs, the overrides have no effect. In case
the build fails, please switch to a larger VM flavor (consult the documentation
of your particular Konflux deployment to see what's available).
For example:
spec: params: - name: build-platforms value: - localhost - - linux/arm64 + - linux-mxlarge/arm64v0.10.7Fixed
ignore files, same as buildah itself.
.containerignoreand.dockerignorefilesin the root of the context directory, but not the
<containerfile>.containerignoreand
<containerfile>.dockerignorefiles.v0.10.6Fixed
versions 0.10.4 and 0.10.5, when the upload-sbom step upgraded cosign to v3.
service URLs directly as CLI flags. The konflux-ci/konflux-ci deployment
of Konflux doesn't provide the config file in the TUF mirror. Fixed
by setting
--use-signing-config=falseto still allow direct URLs.Changed
Previously, if keyless signing was enabled, the task would sign the image
in the push step and then the SBOM in upload-sbom step. Now, it will sign both
in the upload-sbom step. This has no practical impact, but enables a larger
rework of the push step in the future.
v0.10.5Added
--rhsm-mount-ca-certsoption.konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)
v0.3.2Changed
quay.io/konflux-ci/oras:latestimage withquay.io/konflux-ci/task-runner:1.5.0in the oci-attach-report step.Added
v0.3.1Added
konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)
v0.7.0.repofile for RPM dependencies is now namedhermeto.repoinstead ofcachi2.repov0.6.0v0.5.0v0.4.1Fixed
trusted-cavolume in theuse-trusted-artifactandcreate-trusted-artifactsteps.Previously, the mount was missing, which means the task did not support container registries
with certificates signed by a private/self-signed CA.
v0.4.0v0.3.2enable-package-registry-proxyparameter to enable use of the package registry proxy when prefetching dependencies.SERVICE_CA_TRUST_CONFIG_MAP_NAMEandSERVICE_CA_TRUST_CONFIG_MAP_KEYparameters to mount the OpenShift service CA for verifying TLS connections to in-cluster services such as the package registry proxy.konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-show-sbom)
v0.3Fixed
The migration script wasn't attached to the task bundle.
v0.2Removed
The task
show-sbomis deprecated. The migration script deletes it from the pipeline.konflux-ci/konflux-operator-tasks (quay.io/konflux-ci/tekton-catalog/task-validate-fbc)
v0.3Fixed
fbc-inject-lifecycle-oci-tanow resolves the task bundledigest dynamically at migration time instead of using a hardcoded pin, preventing
digest-mismatch errors for teams that had not yet merged the MintMaker PR for
0.2.Changed
yqinstead ofsedfor all pipeline YAML edits,for cross-platform compatibility (macOS + Linux) and safer, structure-aware
modifications (e.g. distinguishing actual task objects from string matches
on
bundle_refor param values).BUILD_ARGSparam wiring tofbc-inject-lifecycle, sourced from$(params.build-args[*])and normalized to a list value.v0.2Changed
fbc-inject-lifecycle-oci-tatask to all FBC builder pipelines via MintMaker. No functional changes to this task.
Configuration
📅 Schedule: (UTC)
* 5-23 * * 6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.
Summary by CodeRabbit
New Features
Maintenance