Skip to content

fix(chains): allow slsa/v2alpha4 attestation format in validation - #4251

Merged
tekton-robot merged 2 commits into
tektoncd:mainfrom
jkhelil:fix/chains-allow-slsa-v2alpha4
Oct 13, 2026
Merged

fix(chains): allow slsa/v2alpha4 attestation format in validation#4251
tekton-robot merged 2 commits into
tektoncd:mainfrom
jkhelil:fix/chains-allow-slsa-v2alpha4

Conversation

@jkhelil

@jkhelil jkhelil commented Oct 12, 2026

Copy link
Copy Markdown
Member

Changes

Allow slsa/v2alpha4 in TektonChain webhook validation for
artifacts.taskrun.format and artifacts.pipelinerun.format.

Chains already supports this format (StepAction type-hints /
isBuildArtifact), but the operator rejected it, forcing consumers
such as Konflux to fall back to slsa/v2alpha3
(see redhat-appstudio/infra-deployments#10570).

Submitter Checklist

Release Notes

Allow configuring Tekton Chains artifacts.*.format as slsa/v2alpha4

@jkhelil
fix(chains): allow slsa/v2alpha4 attestation format in validation
63a6198 
Chains already supports slsa/v2alpha4 for TaskRun and PipelineRun
attestations, but the TektonChain webhook rejected it. Add the format
to the allowlist so operators can configure it without falling back to
v2alpha3.

Signed-off-by: Jawed khelil <jkhelil@redhat.com>
@tekton-robot tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Oct 12, 2026
@tekton-robot tekton-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Oct 12, 2026
@jkhelil jkhelil mentioned this pull request Oct 12, 2026
Open
@codecov

codecov Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.25%. Comparing base (64b3dae) to head (e48058f).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #4251   +/-   ##
=======================================
  Coverage   30.25%   30.25%           
=======================================
  Files         478      478           
  Lines       23169    23169           
=======================================
  Hits         7010     7010           
  Misses      16159    16159
Flag Coverage Δ
unit-tests 30.25% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 13, 2026
enarha
enarha reviewed Oct 13, 2026
View reviewed changes
Comment thread pkg/apis/operator/v1alpha1/tektonchain_validation_test.go Outdated
},
}

for _, format := range []string{"in-toto", "slsa/v1", "slsa/v2alpha2", "slsa/v2alpha3", "slsa/v2alpha4"} {

@enarha enarha Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO this should use the var from pkg/apis/operator/v1alpha1/tektonchain_validation.go. Otherwise if someone removes a value from allowedArtifactsPipelineRunFormat this test will still pass.

Comment thread pkg/apis/operator/v1alpha1/tektonchain_validation_test.go Outdated
},
}

for _, format := range []string{"in-toto", "slsa/v1", "slsa/v2alpha2", "slsa/v2alpha3", "slsa/v2alpha4"} {

@enarha enarha Oct 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the same as above.

@jkhelil
test(chains): drive format validation from allowlist vars
e48058f 
Iterate allowedArtifactsTaskRunFormat and allowedArtifactsPipelineRunFormat
so the tests stay in sync with the webhook allowlists.

Signed-off-by: Jawed khelil <jkhelil@redhat.com>
@jkhelil

jkhelil commented Oct 13, 2026

Copy link
Copy Markdown
Member Author

/kind bug

@tekton-robot tekton-robot added the kind/bug Categorizes issue or PR as related to a bug. label Oct 13, 2026
enarha
enarha approved these changes Oct 13, 2026
View reviewed changes

@enarha enarha left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@tekton-robot

tekton-robot commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enarha, savitaashture

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [enarha,savitaashture]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@pratap0007

pratap0007 commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Oct 13, 2026
@tekton-robot
tekton-robot merged commit 74f0ad1 into tektoncd:main Oct 13, 2026
17 checks passed
@jkhelil

jkhelil commented Oct 13, 2026

Copy link
Copy Markdown
Member Author

/cherry-pick release-v0.81.x

@jkhelil

jkhelil commented Oct 13, 2026

Copy link
Copy Markdown
Member Author

/cherry-pick release-v0.80.x

@tekton-robot

tekton-robot commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

✅ Cherry-pick to release-v0.81.x successful!

A new pull request has been created to cherry-pick this change to release-v0.81.x.

PR: #4259

Please review and merge the cherry-pick PR.

@tekton-robot tekton-robot mentioned this pull request Oct 13, 2026
Merged
3 of 4 tasks
@tekton-robot

tekton-robot commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

✅ Cherry-pick to release-v0.80.x successful!

A new pull request has been created to cherry-pick this change to release-v0.80.x.

PR: #4260

Please review and merge the cherry-pick PR.

@tekton-robot tekton-robot mentioned this pull request Oct 13, 2026
Merged
3 of 4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@savitaashture savitaashture savitaashture approved these changes
@enarha enarha enarha approved these changes
@infernus01 infernus01 Awaiting requested review from infernus01
@pratap0007 pratap0007 Awaiting requested review from pratap0007

Assignees

@pratap0007 pratap0007

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/bug Categorizes issue or PR as related to a bug. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@jkhelil @tekton-robot @pratap0007 @savitaashture @enarha