Konflux CI/CD:
Installation & Reference Guide for OpenShift 4

# ── Prerequisites check ──────────────────────────────────────
oc version            # must be 4.20+
oc version --client  # must be v1.31.4+
git --version         # must be 2.46+
go version            # must be 1.26+
openssl version       # must be 3.0.13+
make --version

# Verify cluster-admin
oc auth can-i '*' '*' --all-namespaces   # must print: yes

# Verify default StorageClass exists (required for PVC binding)
oc get storageclass
# Look for a row with (default) — e.g. gp3-csi (default)

# ── Clone the official Konflux repository ─────────────────────
git clone https://github.com/konflux-ci/konflux-ci.git
cd konflux-ci

# ── NOTE: Pre-export optional variables before running the script ─────────────
#
# The script can automatically configure the GitHub App secret and the Smee
# client if the corresponding environment variables are exported beforehand.
#
# If you already have a GitHub App created and want the script to configure
# everything in one shot, export these before running ./deploy-konflux-on-ocp.sh:
#
#   export GITHUB_APP_ID="123456"                       # numeric App ID from GitHub
#   export WEBHOOK_SECRET="your-webhook-secret"         # secret you set in the GitHub App
#   export GITHUB_PRIVATE_KEY_PATH="/path/to/app.pem"  # private key .pem downloaded from GitHub
#
# Additionally, if your cluster is NOT reachable from the internet (e.g. behind
# a VPN or firewall) and GitHub cannot deliver webhooks directly, also export:
#
#   export SMEE_CHANNEL="https://smee.io/your-channel-id"
#
# When SMEE_CHANNEL is set, the script deploys a Smee proxy client inside the
# cluster that forwards GitHub webhook events to the PaC controller.
#
# If you don't have a GitHub App yet or prefer to configure these manually
# after installation, simply skip the exports — the platform installs fine
# without them. You can run scripts/deploy-secrets.sh standalone afterwards.
# See Phase 3 below for the manual post-installation steps.
#
# ── Run the deployment script ─────────────────────────────────
# This single script does EVERYTHING:
#   - Installs OpenShift Pipelines Operator via OLM (DO NOT pre-install separately)
#   - Installs Red Hat cert-manager Operator via OLM
#   - Deploys Kyverno for namespace RBAC policy
#   - Sets up Tekton Chains RBAC for image signing
#   - Installs Prometheus CRDs for observability
#   - Installs Konflux CRDs (make install in operator/)
#   - Deploys the Konflux Operator to konflux-operator namespace
#   - Applies the default Konflux CR
#   - Waits for the CR to reach Ready
./deploy-konflux-on-ocp.sh

# To use a specific operator image (optional override):
# OPERATOR_IMAGE=quay.io/konflux-ci/konflux-operator:v0.1.0 ./deploy-konflux-on-ocp.sh

# Wait for the Konflux CR to be Ready (the script already does this,
# but run manually if you need to re-check after a restart)
oc wait --for=condition=Ready=True konflux konflux --timeout=600s

# Check the Konflux CR status and component conditions
oc describe konflux konflux

# Verify the Konflux Operator is running
oc get pods -n konflux-operator

# ── Namespace inventory for deploy-konflux-on-ocp.sh on OCP ──
#
# SOURCE A — OpenShift Pipelines OLM Operator (deploy-deps.sh, USE_OPENSHIFT_PIPELINES=true)
#   openshift-pipelines    → TektonConfig targetNamespace on OCP; all Tekton + PaC + Chains
#                            components co-located here (PaC does NOT get its own ns on OCP)
#
# SOURCE B — Red Hat cert-manager OLM Operator (deploy-deps.sh, USE_OPENSHIFT_CERTMANAGER=true)
#   cert-manager-operator  → OLM Subscription + OperatorGroup namespace
#                            (dependencies/cert-manager-subscription/namespace.yaml)
#   cert-manager           → Created by the cert-manager operator itself upon reconciliation
#
# SOURCE C — Kyverno (deploy-deps.sh → dependencies/kyverno/kustomization.yaml)
#   kyverno                → Kyverno policy engine; kyverno/releases/v1.18.1/install.yaml
#
# SOURCE D — Konflux Operator CRDs + deploy (make install + make deploy, Steps 2-3/6)
#   konflux-operator       → operator/config/default (namespace for the operator controller)
#
# SOURCE E — Konflux CR reconciliation (oc apply -f, Step 5/6 — ALWAYS enabled by default)
#   build-service          → operator/pkg/manifests/build-service/manifests.yaml (KonfluxBuildService)
#   integration-service    → operator/pkg/manifests/integration/manifests.yaml (KonfluxIntegrationService)
#   release-service        → operator/pkg/manifests/release/manifests.yaml (KonfluxReleaseService)
#   namespace-lister       → operator/pkg/manifests/namespace-lister/manifests.yaml
#   konflux-ui             → operator/pkg/manifests/ui/manifests.yaml (KonfluxUI)
#   enterprise-contract-service → operator/pkg/manifests/enterprise-contract/manifests.yaml
#   konflux-info           → operator/pkg/manifests/info/manifests.yaml (KonfluxInfo)
#   konflux-cli            → operator/pkg/manifests/cli/manifests.yaml (KonfluxCLI)
#   default-tenant         → operator/pkg/manifests/default-tenant/manifests.yaml
#                            (conditional on spec.defaultTenant.enabled: true — DEFAULT true)
#
# SOURCE F — Konflux CR reconciliation (CONDITIONAL — NOT enabled by default on OCP)
#   image-controller       → spec.imageController.enabled: true  (off by default)
#   segment-bridge         → spec.telemetry.enabled: true        (off by default)
#   kind-registry          → spec.internalRegistry.enabled: true (SKIP_INTERNAL_REGISTRY=true on OCP)
#
# NOT present on OCP (pipeline-operator specific behaviour):
#   pipelines-as-code      → upstream Tekton/Kind only; on OCP PaC runs in openshift-pipelines
#   tekton-pipelines       → upstream Tekton only; OCP uses openshift-pipelines
#   dex                    → SKIP_DEX=true; OCP has its own OAuth
#   application-service    → HAS installs only CRDs (no Namespace in operator/pkg/manifests/application-api/)

echo "=== Always-created namespaces ==="
for ns in \
  openshift-pipelines \
  cert-manager-operator \
  cert-manager \
  kyverno \
  konflux-operator \
  build-service \
  integration-service \
  release-service \
  namespace-lister \
  konflux-ui \
  enterprise-contract-service \
  konflux-info \
  konflux-cli \
  default-tenant; do
  echo ""
  echo "--- $ns ---"
  oc get pods -n "$ns" 2>/dev/null || echo "  (namespace not found or no pods yet)"
done

echo ""
echo "=== Conditionally-created namespaces ==="

# image-controller: only when spec.imageController.enabled: true in the Konflux CR
oc get namespace image-controller &>/dev/null && {
  echo ""
  echo "--- image-controller (imageController.enabled: true) ---"
  oc get pods -n image-controller
} || echo "  image-controller: not present (imageController not enabled in Konflux CR)"

# segment-bridge: only when spec.telemetry.enabled: true in the Konflux CR
oc get namespace segment-bridge &>/dev/null && {
  echo ""
  echo "--- segment-bridge (telemetry.enabled: true) ---"
  oc get pods -n segment-bridge
} || echo "  segment-bridge: not present (telemetry not enabled in Konflux CR)"

# smee-client: only when SMEE_CHANNEL was set during deploy-konflux-on-ocp.sh
oc get namespace smee-client &>/dev/null && {
  echo ""
  echo "--- smee-client (SMEE_CHANNEL was set during install) ---"
  oc get pods -n smee-client
} || echo "  smee-client: not present (cluster is internet-reachable — no Smee proxy needed)"

# Verify all Konflux CRDs are installed
oc api-resources | grep -E 'appstudio|enterprisecontract|konflux'

# Access the Konflux UI
# The Konflux CR creates a Route in its namespace
oc get route -A | grep konflux
# Open the URL in your browser

# ── Issue: Pipelines not triggering on PRs ────────────────────
# Check PaC can reach GitHub (must have valid GitHub App secret in all 3 namespaces)
# On OCP: openshift-pipelines (NOT pipelines-as-code — that is the upstream/Kind namespace)
oc get secret pipelines-as-code-secret -n openshift-pipelines
oc get secret pipelines-as-code-secret -n build-service
oc get secret pipelines-as-code-secret -n integration-service  # all 3 must exist!

# Check PaC controller logs for webhook delivery errors
# On OCP, PaC controller runs in openshift-pipelines (not pipelines-as-code)
oc logs -n openshift-pipelines \
  -l app.kubernetes.io/component=controller,app.kubernetes.io/part-of=pipelines-as-code --tail=50

# Check the Repository CRD status
oc describe repository testrepo -n default-tenant

# If cluster is not internet-reachable, set up Smee proxy:
# 1. Generate a channel: head -c 30 /dev/random | base64 | tr -dc 'a-zA-Z0-9'
# 2. Use https://smee.io/<channel-id> as webhook URL in GitHub App
# 3. The smee client must be deployed in the cluster as a Deployment

# ── Issue: Build PVC stuck in Pending ─────────────────────────
# Verify default StorageClass supports ReadWriteOnce
oc get storageclass
oc describe pvc -n default-tenant | grep -A 10 Events

# ── Issue: Running out of resources ───────────────────────────
oc get nodes -o custom-columns=NAME:.metadata.name,CPU:.status.allocatable.cpu,MEMORY:.status.allocatable.memory
oc top nodes  # requires metrics-server

# ── Issue: Unable to create Application via UI (404 error) ────
# Ensure image-controller is enabled and the quaytoken secret is in image-controller ns
oc get secret quaytoken -n image-controller
oc get pods -n image-controller

# ── Issue: Conflict CR status — check Konflux CR conditions ───
oc describe konflux konflux | grep -A 30 "Conditions:"

# ── Uninstall Konflux ─────────────────────────────────────────
# Remove the CR (this removes all managed components)
oc delete konflux konflux
# Remove the operator and CRDs
cd operator
make undeploy
make uninstall

# ── STEP A: Generate a webhook secret (save this value) ───────
WEBHOOK_SECRET=$(head -c 30 /dev/random | base64)
echo "Your webhook secret: $WEBHOOK_SECRET"

# ── STEP A2: Get the PaC controller Route hostname BEFORE creating the GitHub App ──
# On OCP, the OpenShift Pipelines operator creates a Route for the PaC controller
# in the openshift-pipelines namespace. This is the URL GitHub will POST events to.
#
# Wait for the Route to exist (the OpenShift Pipelines operator creates it after
# TektonConfig reaches Ready — may take 2-3 minutes after install completes)
echo "Waiting for PaC controller Route to be created..."
until oc get route pipelines-as-code-controller -n openshift-pipelines &>/dev/null; do
  echo "  Route not ready yet, retrying in 10s..."
  sleep 10
done

# Extract the full HTTPS webhook URL — use this exactly in the GitHub App "Webhook URL" field
WEBHOOK_URL=$(oc get route pipelines-as-code-controller \
  -n openshift-pipelines \
  -o jsonpath='https://{.spec.host}')
echo ""
echo "================================================"
echo "  PaC Webhook URL (copy this into GitHub App):"
echo "  $WEBHOOK_URL"
echo "================================================"

# Verify the URL is reachable from your machine (optional sanity check)
# -k / --insecure is needed when the Route uses a self-signed or internal CA certificate,
# which is common on OpenShift clusters that haven't configured a custom ingress cert.
curl -sk -o /dev/null -w "HTTP status: %{http_code}\n" "$WEBHOOK_URL" || \
  echo "Note: curl failed — confirm the cluster is internet-reachable from GitHub"

# ── NOTE: If the pipelines-as-code-controller Route is NOT reachable from the internet ──
#
# GitHub needs to POST webhook events to the PaC controller URL ($WEBHOOK_URL above).
# If your cluster sits behind a VPN, firewall, or private network, GitHub cannot reach
# that Route directly. In that case you must use a Smee proxy channel as the webhook URL.
#
# 1. Go to https://smee.io/ and click "Start a new channel" — you will get a unique URL
#    like: https://smee.io/abc123XYZ
#
# 2. Use that Smee URL as the Webhook URL when creating the GitHub App in STEP B below
#    (instead of the $WEBHOOK_URL printed above).
#
# 3. Export the channel URL before running deploy-konflux-on-ocp.sh so the script
#    deploys the Smee client inside the cluster automatically:
#      export SMEE_CHANNEL="https://smee.io/abc123XYZ"
#    Or deploy it manually after installation — see the Smee deployment commands
#    in the Phase 1 NOTE above.

# ── STEP B: Create the GitHub App in your browser ─────────────
# 1. Go to: https://github.com/settings/apps/new
#    (or https://github.com/organizations/YOUR-ORG/settings/apps/new for an org)
#
# 2. Fill in the form:
#    GitHub App name:  "My Konflux CI"  (must be globally unique on GitHub)
#    Homepage URL:     https://localhost:9443  (value does not matter)
#    Webhook:          Active = YES (toggle on)
#    Webhook URL:      Paste the value of $WEBHOOK_URL printed by STEP A2 above.
#                      It looks like:
#                      https://pipelines-as-code-controller-openshift-pipelines.apps.<cluster-domain>
#                      ──────────────────────────────────────────────────────────────────────────────
#                      If the cluster is NOT internet-reachable from GitHub (e.g. behind a firewall
#                      or a private VPN), use a smee.io channel URL instead:
#                        SMEE_CHANNEL=$(head -c 30 /dev/random | base64 | tr -dc 'a-zA-Z0-9')
#                        echo "https://smee.io/$SMEE_CHANNEL"
#                      Then re-run deploy-konflux-on-ocp.sh with:
#                        SMEE_CHANNEL="https://smee.io/$SMEE_CHANNEL" ./deploy-konflux-on-ocp.sh
#    Webhook secret:   Paste the value of $WEBHOOK_SECRET from STEP A above.
#
# 3. Repository permissions — set these exactly:
#    Checks:           Read & Write
#    Contents:         Read & Write
#    Issues:           Read & Write
#    Metadata:         Read-only (required, auto-selected)
#    Pull requests:    Read & Write
#    Commit statuses:  Read & Write
#
# 4. Subscribe to events — check all of these:
#    ✅ Check run
#    ✅ Commit comment
#    ✅ Issue comment
#    ✅ Pull request
#    ✅ Push
#
# 5. Where can this GitHub App be installed? → Any account
#
# 6. Click "Create GitHub App"
#    → Note the numeric App ID shown on the next page (e.g. 123456)
#
# 7. Scroll down → "Private keys" → "Generate a private key"
#    → A .pem file downloads automatically — note its path
#
# 8. Install the App on your repositories:
#    → Left sidebar: "Install App" → your org/user → All repositories
#    (or select specific repos)

# ── STEP C: Deploy the secret to ALL 3 required namespaces ────
# Source: https://raw.githubusercontent.com/konflux-ci/konflux-ci/refs/heads/main/scripts/deploy-secrets.sh
#
# This block mirrors scripts/deploy-secrets.sh create_github_integration_secrets()
# exactly — same flag syntax, same two-path conditional, same secret key names.
#
# On OCP (USE_OPENSHIFT_PIPELINES=true):
#   pac_ns is set to "openshift-pipelines", not "pipelines-as-code".
#   The loop targets: openshift-pipelines  build-service  integration-service

GITHUB_APP_ID="123456"                          # replace with your App ID from Step B.6
GITHUB_PRIVATE_KEY_PATH="/path/to/github-app.pem"  # path to the .pem from Step B.7
# WEBHOOK_SECRET is already set from STEP A above

# The official script has two code paths depending on how the private key is provided:
#   Path A — key is a file on disk (GITHUB_PRIVATE_KEY_PATH set + file exists)
#   Path B — key is passed as a literal string (e.g. from a CI env var: GITHUB_PRIVATE_KEY)
# Match this exactly so the secret data format is identical to what the script produces.

for ns in openshift-pipelines build-service integration-service; do
  echo "Creating secret in ${ns}..."

  if [ -n "${GITHUB_PRIVATE_KEY_PATH:-}" ] && [ -f "${GITHUB_PRIVATE_KEY_PATH}" ]; then
    # Path A: read private key from a .pem file (most common for interactive installs)
    oc -n "$ns" create secret generic pipelines-as-code-secret \
      --from-file=github-private-key="$GITHUB_PRIVATE_KEY_PATH" \
      --from-literal github-application-id="$GITHUB_APP_ID" \
      --from-literal webhook.secret="$WEBHOOK_SECRET" \
      --dry-run=client -o yaml | oc apply -f -
  else
    # Path B: key content is already in the GITHUB_PRIVATE_KEY env var (CI pipelines)
    oc -n "$ns" create secret generic pipelines-as-code-secret \
      --from-literal github-private-key="$GITHUB_PRIVATE_KEY" \
      --from-literal github-application-id="$GITHUB_APP_ID" \
      --from-literal webhook.secret="$WEBHOOK_SECRET" \
      --dry-run=client -o yaml | oc apply -f -
  fi
done

# Verify the secret exists in all 3 namespaces
echo ""
echo "Secret verification:"
for ns in openshift-pipelines build-service integration-service; do
  echo -n "  $ns — App ID: "
  oc get secret pipelines-as-code-secret -n $ns \
    -o jsonpath='{.data.github-application-id}' 2>/dev/null | base64 -d \
    || echo '(missing!)'
  echo ""
done

# ── STEP D: image-controller Quay secret (optional) ──────────
# Required ONLY when spec.imageController.enabled: true in the Konflux CR.
# image-controller auto-creates Quay.io repos when you onboard Components
# via the Konflux UI. Skip entirely if you create Components with oc.
#
# ⚠ This step is NOT covered here — refer to the official documentation:
#
#   quay.io (cloud):
#   https://konflux-ci.dev/konflux-ci/docs/guides/registry-configuration/#quayio-auto-provisioning-image-controller
#
#   Self-hosted Quay registry:
#   https://konflux-ci.dev/konflux-ci/docs/guides/registry-configuration/#self-hosted-quay-registry

# Ref: https://konflux-ci.dev/docs/installation/registry-configuration/
#
# SEQUENCING:
#   Part A (NOW — before Phase 5): verify tenant namespace + create regcred secret
#   Part B (AFTER Phase 5):        patch regcred onto the Component ServiceAccount
#                                  (the SA doesn't exist until Build Service reconciles
#                                   the Component CR, so Part B must come after)

# ═══════════════════════════════════════════════════════════════
# PART A — Run before Phase 5
# ═══════════════════════════════════════════════════════════════

# ── Step 1: Verify the tenant namespace ────────────────────────
NS="default-tenant"   # or your custom namespace name

oc get namespace "$NS" --show-labels
# Required label: konflux-ci.dev/type=tenant
# If it's missing, label it:
#   oc label namespace "$NS" konflux-ci.dev/type=tenant

# To create a brand-new custom tenant namespace:
# oc create namespace my-team-tenant
# oc label namespace my-team-tenant \
#   konflux-ci.dev/type=tenant \
#   pod-security.kubernetes.io/audit=baseline \
#   pod-security.kubernetes.io/audit-version=latest \
#   pod-security.kubernetes.io/warn=baseline \
#   pod-security.kubernetes.io/warn-version=latest

# ── Step 2: Create the regcred push secret ─────────────────────
# For how to obtain registry credentials for quay.io, Docker Hub, or any
# other OCI-compatible registry, refer to the official documentation:
#
#   https://konflux-ci.dev/konflux-ci/docs/guides/registry-configuration/#obtaining-registry-credentials
#
# Once you have your credentials as a Docker config JSON file, create the secret:

REGISTRY_AUTH_JSON="/path/to/your/auth.json"   # path to your Docker config JSON file

# Delete first to avoid "field is immutable" error on re-runs
oc delete secret regcred -n "$NS" --ignore-not-found

oc create secret generic regcred \
  --from-file=.dockerconfigjson="${REGISTRY_AUTH_JSON}" \
  --type=kubernetes.io/dockerconfigjson \
  -n "$NS"

# ── Label the secret so Build Service links it to all Component SAs automatically ──
# The label below marks regcred as a "common secret" for the tenant namespace.
# Build Service watches for this label and automatically mounts the secret onto
# every build-pipeline-<component-name> ServiceAccount it creates, so you do
# NOT need to manually patch each SA after onboarding a new Component (Phase 5 Part B).
oc label secret regcred \
  -n "$NS" \
  build.appstudio.openshift.io/common-secret=true

# ── Step 3: Confirm the secret was created correctly ───────────
oc get secret regcred -n "$NS"
oc get secret regcred -n "$NS" \
  -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d | python3 -m json.tool

# Confirm the label is present
oc get secret regcred -n "$NS" --show-labels

## Step 1: Fork https://github.com/konflux-ci/testrepo (click Fork in GitHub)
##
## ⚠ IMPORTANT — GitHub App installation on the forked repo:
##   In Phase 3 Step B.8 you installed the GitHub App. If you chose
##   "Only select repositories" (rather than "All repositories") the App
##   is NOT installed on your new fork and PaC webhooks will be silently ignored.
##
##   To add the fork now:
##     GitHub → Settings → Applications → <Your App Name> → Configure
##     → Repository access → "Only select repositories"
##     → Add your fork → Save
##
##   Alternatively, switch the App to "All repositories" to avoid this for
##   every future fork or new repository you onboard to Konflux.
##
## Step 2: Confirm the GitHub App is installed on the fork (see note above)
## Step 3: Apply the Application and Component resources below

---
# The Application is a logical grouping of related Components
apiVersion: appstudio.redhat.com/v1alpha1
kind: Application
metadata:
  name: my-first-app
  namespace: default-tenant    # your tenant namespace
spec:
  displayName: My First Konflux Application

---
# The Component points to the source repository and target image
apiVersion: appstudio.redhat.com/v1alpha1
kind: Component
metadata:
  name: testrepo
  namespace: default-tenant
spec:
  application: my-first-app
  componentName: testrepo
  source:
    git:
      url: https://github.com/YOUR-USERNAME/testrepo.git  # your fork
      revision: main
  containerImage: quay.io/YOUR-ORG/testrepo    # where to push the image


## NOTE: Do NOT create a Repository CR manually.
## When the Build Service reconciles the Component CR above, it automatically:
##   1. Creates the pipelinesascode.tekton.dev/v1alpha1 Repository object
##   2. Opens a PR on your fork adding the .tekton/ pipeline definitions
## You will see this PR appear in your GitHub fork shortly after applying
## the Component. Merge it (or follow Phase 6 steps) to activate builds.

NS="default-tenant"

# ── Step 1: Verify the Component was accepted by the Build Service ──
# The Build Service records its reconciliation result in the annotation
# build.appstudio.openshift.io/status (not in status.conditions).
# A successful reconciliation shows: {"pac":{"state":"enabled",...}}
oc get component testrepo -n "$NS" \
  -o jsonpath='{.metadata.annotations.build\.appstudio\.openshift\.io/status}' \
  | python3 -m json.tool

# ── Step 2: Verify the Repository CR was auto-created ──────────
# The Build Service creates the pipelinesascode.tekton.dev/v1alpha1 Repository
# object automatically — you do NOT need to create it manually.
oc get repository -n "$NS"

# The NAME column from the command above is what you pass to describe.
# It typically matches the Component name but use the exact value shown.
REPO_NAME=$(oc get repository -n "$NS" -o jsonpath='{.items[0].metadata.name}')
echo "Repository name: $REPO_NAME"
oc describe repository "$REPO_NAME" -n "$NS"

# ── Step 3: Find the auto-generated PR in your GitHub fork ─────
# Shortly after the Component CR was applied, the Build Service (via PaC)
# opened a PR on your fork adding a .tekton/ directory with two pipeline files:
#   .tekton/testrepo-pull-request.yaml  → runs on every PR opened/updated
#   .tekton/testrepo-push.yaml          → runs on every merge to main
#
# Go to your fork on GitHub and look for this open PR.
# It will be titled something like: "Add Konflux CI pipelines"
# URL: https://github.com/YOUR-USERNAME/testrepo/pulls
#
# IMPORTANT: Make sure the PR base is set to YOUR fork's main branch,
# not the upstream konflux-ci/testrepo. GitHub sometimes defaults to the
# upstream — change it before merging.

# ── Step 4: Wait for the pull-request PipelineRun to complete ──
# Opening the auto-generated PR is itself a pull_request event. PaC
# immediately triggers the pull-request pipeline (.tekton/testrepo-pull-request.yaml)
# against the PR branch. This is a lighter build (no image push, no signing)
# that verifies the component builds successfully before the PR is merged.
#
# Watch for the pull-request PipelineRun to appear (may take 10-30 seconds
# after the PR is opened on GitHub):
oc get pipelinerun -n "$NS" -w
# Look for a PipelineRun whose name contains "pull-request" or "on-pull-request"

# Follow its logs:
tkn pipelinerun logs --last -f -n "$NS"

# Wait until the PipelineRun shows Succeeded before proceeding:
oc get pipelinerun -n "$NS" \
  --sort-by=.metadata.creationTimestamp \
  -o custom-columns="NAME:.metadata.name,STATUS:.status.conditions[0].reason,STARTED:.metadata.creationTimestamp"
# STATUS must be "Succeeded" — do NOT merge the PR until all tasks pass

# The GitHub PR will also show a green check from PaC once the pipeline passes.
# Only proceed to Step 5 when you see the check mark on the PR.

# ── Step 5: Approve and merge the PR ───────────────────────────
# Once the pull-request PipelineRun has Succeeded and the GitHub check is green,
# review the generated .tekton/ pipeline files, then merge the PR.
#
# Go to: https://github.com/YOUR-USERNAME/testrepo/pulls
#   → Open the auto-generated PR
#   → Confirm all checks pass (green ✓ from PaC)
#   → Click "Merge pull request" → "Confirm merge"
#
# DO NOT merge if the pull-request PipelineRun is still running or has failed —
# the pipeline files may have an issue that needs to be resolved first.

# ── Step 6: After merging the PR — the push pipeline triggers ──
# Merging the PR is a push event to main. PaC delivers the webhook to the
# cluster and creates a NEW PipelineRun for the push pipeline automatically.
# This is the FULL build pipeline (clone → build → scan → sign → push image).
# Watch for it to appear (may take 10-30 seconds after the merge):
oc get pipelinerun -n "$NS" -w
# Look for a second PipelineRun whose name contains "push" or "on-push"

# ── Step 7: Follow the push build logs ─────────────────────────
tkn pipelinerun logs --last -f -n "$NS"

# ── Step 8: Verify the build results ───────────────────────────
# After the push pipeline succeeds the Integration Service creates a Snapshot
oc get snapshot -n "$NS"

# Extract the built image URL and digest from the PipelineRun results
PR_NAME=$(oc get pipelinerun -n "$NS" \
  --sort-by=.metadata.creationTimestamp \
  -o jsonpath='{.items[-1].metadata.name}')

IMAGE_URL=$(oc get pipelinerun "$PR_NAME" -n "$NS" \
  -o jsonpath='{.status.results[?(@.name=="IMAGE_URL")].value}')
IMAGE_DIGEST=$(oc get pipelinerun "$PR_NAME" -n "$NS" \
  -o jsonpath='{.status.results[?(@.name=="IMAGE_DIGEST")].value}')

echo "Built image: ${IMAGE_URL}@${IMAGE_DIGEST}"

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  annotations:
    # Replace YOUR-USERNAME with your GitHub username (owner of your testrepo fork)
    build.appstudio.openshift.io/repo: https://github.com/YOUR-USERNAME/testrepo?rev={{revision}}
    build.appstudio.redhat.com/commit_sha: '{{revision}}'
    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
    # cancel-in-progress: false — a new push to main does NOT cancel an in-flight push run.
    # Push builds produce production images; letting them finish ensures the Snapshot
    # and integration tests always correspond to a completed, signed image.
    pipelinesascode.tekton.dev/cancel-in-progress: "false"
    pipelinesascode.tekton.dev/max-keep-runs: "3"
    pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "main"
  labels:
    appstudio.openshift.io/application: my-first-app
    appstudio.openshift.io/component: testrepo
    pipelines.appstudio.openshift.io/type: build
  name: testrepo-on-push
  namespace: default-tenant
spec:
  params:
  - name: git-url
    value: '{{source_url}}'
  - name: revision
    value: '{{revision}}'
  # Replace YOUR-ORG with your quay.io username or org.
  # Must match the containerImage field in your Component CR.
  - name: output-image
    value: quay.io/YOUR-ORG/testrepo:{{revision}}
  - name: dockerfile
    value: Dockerfile
  # ── skip-checks ────────────────────────────────────────────────────────────────
  # Set to "true" on CRC arm64 (Silicon Mac) — the post-build scan task images
  # (Clair, ClamAV, SAST, ecosystem-cert-preflight-checks) are built amd64-only
  # and cannot be pulled on an arm64 node. This skips ALL post-build checks via
  # the when conditions built into the bundle pipeline.
  # Remove this param (or set to "false") on a full amd64 cluster or hosted Konflux.
  - name: skip-checks
    value: "true"

  # ── Pipeline bundle ─────────────────────────────────────────────────────────────
  # References the full pipeline-docker-build-oci-ta pipeline as an OCI bundle,
  # pinned by digest for reproducibility. The bundle includes all standard tasks:
  # init, clone, prefetch, buildah, build-image-index, SAST, Clair, ClamAV,
  # deprecated-image-check, rpms-signature-scan, apply-tags, push-dockerfile.
  #
  # To add custom tasks (e.g. print-build-summary), switch to the inline
  # pipelineSpec approach shown in item 17 — pipelineRef does not support
  # appending tasks (Tekton constraint).
  pipelineRef:
    resolver: bundles
    params:
    - name: bundle
      value: quay.io/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta@sha256:49d8470b97d44f0e557b73d50e7f96c21238bcf66b603e7450ed4927842036ce
    - name: name
      value: docker-build-oci-ta
    - name: kind
      value: pipeline

  taskRunTemplate:
    serviceAccountName: build-pipeline-testrepo
  workspaces:
  - name: git-auth
    secret:
      secretName: '{{ git_auth_secret }}'
status: {}

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  annotations:
    # Replace YOUR-USERNAME with your GitHub username (owner of your testrepo fork)
    build.appstudio.openshift.io/repo: https://github.com/YOUR-USERNAME/testrepo?rev={{revision}}
    build.appstudio.redhat.com/commit_sha: '{{revision}}'
    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
    # cancel-in-progress: true — a new push to the same PR cancels the prior run.
    # PR builds are disposable feedback loops; there is no point running an old
    # commit once a newer one has been pushed to the same branch.
    pipelinesascode.tekton.dev/cancel-in-progress: "true"
    pipelinesascode.tekton.dev/max-keep-runs: "3"
    pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch == "main"
  labels:
    appstudio.openshift.io/application: my-first-app
    appstudio.openshift.io/component: testrepo
    pipelines.appstudio.openshift.io/type: build
  name: testrepo-on-pull-request
  namespace: default-tenant
spec:
  params:
  - name: git-url
    value: '{{source_url}}'
  - name: revision
    value: '{{revision}}'
  # Replace YOUR-ORG with your quay.io username or org.
  # The on-pr- prefix and short expiry mark this as a disposable PR image —
  # it is NOT promoted by the release pipeline.
  - name: output-image
    value: quay.io/YOUR-ORG/testrepo:on-pr-{{revision}}
  # PR images expire after 5 days — they exist only for local testing and
  # integration-test feedback. Push images have no expiry by default.
  - name: image-expires-after
    value: 5d
  - name: dockerfile
    value: Dockerfile
  # ── skip-checks ────────────────────────────────────────────────────────────────
  # Same reasoning as the push pipeline: required on CRC arm64 (Silicon Mac)
  # because the scan task images are amd64-only. Remove on a full cluster.
  - name: skip-checks
    value: "true"

  # ── Pipeline bundle ─────────────────────────────────────────────────────────────
  # Same pinned bundle as the push pipeline. All standard tasks are included.
  # The bundle handles skip-checks internally via when conditions on each task —
  # no manual task list editing required.
  #
  # To add the pr-build-summary custom task shown in item 17, switch to the
  # inline pipelineSpec approach — pipelineRef does not support appending tasks.
  pipelineRef:
    resolver: bundles
    params:
    - name: bundle
      value: quay.io/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta@sha256:49d8470b97d44f0e557b73d50e7f96c21238bcf66b603e7450ed4927842036ce
    - name: name
      value: docker-build-oci-ta
    - name: kind
      value: pipeline

  taskRunTemplate:
    serviceAccountName: build-pipeline-testrepo
  workspaces:
  - name: git-auth
    secret:
      secretName: '{{ git_auth_secret }}'
status: {}

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  annotations:
    # Replace YOUR-USERNAME with your GitHub username (owner of your testrepo fork)
    build.appstudio.openshift.io/repo: https://github.com/YOUR-USERNAME/testrepo?rev={{revision}}
    build.appstudio.redhat.com/commit_sha: '{{revision}}'
    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
    pipelinesascode.tekton.dev/cancel-in-progress: "false"
    pipelinesascode.tekton.dev/max-keep-runs: "3"
    pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "main"
  labels:
    # Must match the Application CR name created in Phase 5 (metadata.name of the Application)
    appstudio.openshift.io/application: my-first-app
    # Must match the Component CR name created in Phase 5 (metadata.name of the Component)
    appstudio.openshift.io/component: testrepo
    pipelines.appstudio.openshift.io/type: build
  # Conventionally -on-push; must be unique within the namespace
  name: testrepo-on-push
  # Your tenant namespace — where the Application and Component CRs were created
  namespace: default-tenant
spec:
  params:
  - name: git-url
    value: '{{source_url}}'
  - name: revision
    value: '{{revision}}'
  - name: output-image
    # Replace YOUR-ORG with your quay.io username or org
    # Must match the containerImage field in your Component CR (Phase 5)
    value: quay.io/YOUR-ORG/testrepo:{{revision}}
  - name: dockerfile
    value: Dockerfile
  pipelineSpec:
    description: |
      Customized Konflux build pipeline for testrepo. Extends the default
      minimal OCI trusted-artifacts pipeline with a custom `print-build-summary`
      task (see inline taskSpec below). All standard scan tasks run in parallel
      after the build and are controlled by the skip-checks parameter. Scans
      are always enabled on the push (production) pipeline.
    params:
    - description: Source Repository URL
      name: git-url
      type: string
    - default: ""
      description: Revision of the Source Repository
      name: revision
      type: string
    - description: Fully Qualified Output Image
      name: output-image
      type: string
    - default: .
      description: Path to the source code of an application's component from where
        to build image.
      name: path-context
      type: string
    - default: Dockerfile
      description: Path to the Dockerfile inside the context specified by parameter
        path-context
      name: dockerfile
      type: string
    - default: "false"
      description: Skip checks against built image
      name: skip-checks
      type: string
    - default: "false"
      description: Execute the build with network isolation
      name: hermetic
      type: string
    - default: ""
      description: Build dependencies to be prefetched
      name: prefetch-input
      type: string
    - default: ""
      description: Image tag expiration time, time values could be something like
        1h, 2d, 3w for hours, days, and weeks, respectively.
      name: image-expires-after
      type: string
    - default: "false"
      description: Add built image into an OCI image index
      name: build-image-index
      type: string
    - default: docker
      description: The format for the resulting image's mediaType. Valid values are
        oci or docker.
      name: buildah-format
      type: string
    - default: "false"
      description: Enable cache proxy configuration
      name: enable-cache-proxy
    - default: "true"
      description: Use the package registry proxy when prefetching dependencies
      name: enable-package-registry-proxy
    - default: .
      description: Target directories in component's source code to scan with SAST
        tools. Multiple values should be separated with commas.
      name: sast-target-dirs
      type: string
    - default: []
      description: Array of --build-arg values ("arg=value" strings) for buildah
      name: build-args
      type: array
    - default: ""
      description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file
      name: build-args-file
      type: string
    - default: "false"
      description: Whether to enable privileged mode, should be used only with remote
        VMs
      name: privileged-nested
      type: string
    results:
    - description: ""
      name: IMAGE_URL
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - description: ""
      name: IMAGE_DIGEST
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - description: ""
      name: CHAINS-GIT_URL
      value: $(tasks.clone-repository.results.url)
    - description: ""
      name: CHAINS-GIT_COMMIT
      value: $(tasks.clone-repository.results.commit)
    tasks:
    # ── DEFAULT TASKS (unchanged from the generated pipeline) ─────────────────
    - name: init
      params:
      - name: enable-cache-proxy
        value: $(params.enable-cache-proxy)
      taskRef:
        params:
        - name: name
          value: init
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db
        - name: kind
          value: task
        resolver: bundles
    - name: clone-repository
      params:
      - name: url
        value: $(params.git-url)
      - name: revision
        value: $(params.revision)
      - name: ociStorage
        value: $(params.output-image).git
      - name: ociArtifactExpiresAfter
        value: $(params.image-expires-after)
      runAfter:
      - init
      taskRef:
        params:
        - name: name
          value: git-clone-oci-ta-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.2@sha256:83bffb5ef4589830c8d0f606325fb27e8cd680c8404d5a935f6660174c9e118c
        - name: kind
          value: task
        resolver: bundles
      workspaces:
      - name: basic-auth
        workspace: git-auth
    - name: prefetch-dependencies
      params:
      - name: input
        value: $(params.prefetch-input)
      - name: enable-package-registry-proxy
        value: $(params.enable-package-registry-proxy)
      - name: SOURCE_ARTIFACT
        value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
      - name: ociStorage
        value: $(params.output-image).prefetch
      - name: ociArtifactExpiresAfter
        value: $(params.image-expires-after)
      runAfter:
      - clone-repository
      taskRef:
        params:
        - name: name
          value: prefetch-dependencies-oci-ta-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3.2@sha256:7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03
        - name: kind
          value: task
        resolver: bundles
      workspaces:
      - name: git-basic-auth
        workspace: git-auth
      - name: netrc
        workspace: netrc
    - name: build-container
      params:
      - name: IMAGE
        value: $(params.output-image)
      - name: DOCKERFILE
        value: $(params.dockerfile)
      - name: CONTEXT
        value: $(params.path-context)
      - name: HERMETIC
        value: $(params.hermetic)
      - name: PREFETCH_INPUT
        value: $(params.prefetch-input)
      - name: IMAGE_EXPIRES_AFTER
        value: $(params.image-expires-after)
      - name: COMMIT_SHA
        value: $(tasks.clone-repository.results.commit)
      - name: BUILD_ARGS
        value:
        - $(params.build-args[*])
      - name: BUILD_ARGS_FILE
        value: $(params.build-args-file)
      - name: PRIVILEGED_NESTED
        value: $(params.privileged-nested)
      - name: SOURCE_URL
        value: $(tasks.clone-repository.results.url)
      - name: BUILDAH_FORMAT
        value: $(params.buildah-format)
      - name: HTTP_PROXY
        value: $(tasks.init.results.http-proxy)
      - name: NO_PROXY
        value: $(tasks.init.results.no-proxy)
      - name: SOURCE_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
      - name: CACHI2_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
      runAfter:
      - prefetch-dependencies
      taskRef:
        params:
        - name: name
          value: buildah-oci-ta-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.10@sha256:72c599425e0bda63c30e10127dc493d139c75e45b986d8b7627a0d1b94aafff8
        - name: kind
          value: task
        resolver: bundles
    - name: build-image-index
      params:
      - name: IMAGE
        value: $(params.output-image)
      - name: ALWAYS_BUILD_INDEX
        value: $(params.build-image-index)
      - name: IMAGES
        value:
        - $(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST)
      - name: BUILDAH_FORMAT
        value: $(params.buildah-format)
      runAfter:
      - build-container
      taskRef:
        params:
        - name: name
          value: build-image-index-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:3279101e95f35b768877ae9e7620e92984bd72907e79ea5fefade39d56cc93a3
        - name: kind
          value: task
        resolver: bundles
    # ── CUSTOM TASK: print-build-summary ─────────────────────────────────────
    # This task is NOT part of the default pipeline — it demonstrates how to
    # add a custom step using an inline taskSpec (no separate Task CRD or OCI
    # bundle required). It runs in the post-build parallel fan-out alongside
    # the scan tasks and never blocks them.
    #
    # Key concepts shown here:
    #   taskSpec   — embeds the Task definition directly in the PipelineRun
    #   runAfter   — places this task after build-image-index in the DAG
    #   params     — receives upstream task results via $(tasks..results.)
    #
    # To add your own step: copy this block, rename it, change the image and
    # script, and update runAfter to the task it depends on.
    - name: print-build-summary
      params:
      - name: IMAGE_URL
        value: $(tasks.build-image-index.results.IMAGE_URL)
      - name: IMAGE_DIGEST
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      - name: GIT_URL
        value: $(tasks.clone-repository.results.url)
      - name: GIT_COMMIT
        value: $(tasks.clone-repository.results.commit)
      runAfter:
      - build-image-index
      taskSpec:
        params:
        - name: IMAGE_URL
          type: string
        - name: IMAGE_DIGEST
          type: string
        - name: GIT_URL
          type: string
        - name: GIT_COMMIT
          type: string
        steps:
        - name: summarize
          image: registry.access.redhat.com/ubi9/ubi-minimal:latest
          script: |
            #!/bin/bash
            echo "=================================================="
            echo "           KONFLUX BUILD SUMMARY"
            echo "=================================================="
            printf '%-22s %s\n' "Source repository:"  "$(params.GIT_URL)"
            printf '%-22s %s\n' "Git commit:"         "$(params.GIT_COMMIT)"
            printf '%-22s %s\n' "Built image URL:"    "$(params.IMAGE_URL)"
            printf '%-22s %s\n' "Image digest:"       "$(params.IMAGE_DIGEST)"
            echo "=================================================="
            echo ""
            echo "Pull the image:"
            echo "  podman pull $(params.IMAGE_URL)@$(params.IMAGE_DIGEST)"
            echo ""
            echo "Verify the signature (Tekton Chains signs after PipelineRun):"
            echo "  cosign verify --key cosign.pub --insecure-ignore-tlog \\"
            echo "    $(params.IMAGE_URL)@$(params.IMAGE_DIGEST)"
    # ── END CUSTOM TASK ───────────────────────────────────────────────────────
    - name: deprecated-base-image-check
      params:
      - name: IMAGE_URL
        value: $(tasks.build-image-index.results.IMAGE_URL)
      - name: IMAGE_DIGEST
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: deprecated-image-check
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    - name: clamav-scan
      params:
      - name: image-digest
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      - name: image-url
        value: $(tasks.build-image-index.results.IMAGE_URL)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: clamav-scan-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    - name: sast-shell-check
      params:
      - name: image-digest
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      - name: image-url
        value: $(tasks.build-image-index.results.IMAGE_URL)
      - name: TARGET_DIRS
        value: $(params.sast-target-dirs)
      - name: SOURCE_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
      - name: CACHI2_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: sast-shell-check-oci-ta-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    - name: sast-unicode-check
      params:
      - name: image-digest
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      - name: image-url
        value: $(tasks.build-image-index.results.IMAGE_URL)
      - name: TARGET_DIRS
        value: $(params.sast-target-dirs)
      - name: SOURCE_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
      - name: CACHI2_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: sast-unicode-check-oci-ta-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    - name: rpms-signature-scan
      params:
      - name: image-url
        value: $(tasks.build-image-index.results.IMAGE_URL)
      - name: image-digest
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: rpms-signature-scan
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:65370ccb44ff82e4ce128addd913f3c96b298607b3760ee1339ed10011a4bd6b
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    - name: tpa-scan
      params:
      - name: image-digest
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      - name: image-url
        value: $(tasks.build-image-index.results.IMAGE_URL)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: tpa-scan
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    workspaces:
    - name: git-auth
      optional: true
    - name: netrc
      optional: true
  taskRunTemplate:
    # Auto-created by Build Service as build-pipeline-
    # For a component named "testrepo" this is automatically build-pipeline-testrepo
    serviceAccountName: build-pipeline-testrepo
  workspaces:
  - name: git-auth
    secret:
      secretName: '{{ git_auth_secret }}'
status: {}

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  annotations:
    # Replace YOUR-USERNAME with your GitHub username (owner of your testrepo fork)
    build.appstudio.openshift.io/repo: https://github.com/YOUR-USERNAME/testrepo?rev={{revision}}
    build.appstudio.redhat.com/commit_sha: '{{revision}}'
    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
    pipelinesascode.tekton.dev/cancel-in-progress: "true"
    pipelinesascode.tekton.dev/max-keep-runs: "3"
    pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch == "main"
  labels:
    # Must match the Application CR name created in Phase 5 (metadata.name of the Application)
    appstudio.openshift.io/application: my-first-app
    # Must match the Component CR name created in Phase 5 (metadata.name of the Component)
    appstudio.openshift.io/component: testrepo
    pipelines.appstudio.openshift.io/type: build
  # Conventionally -on-pull-request; must be unique within the namespace
  name: testrepo-on-pull-request
  # Your tenant namespace — where the Application and Component CRs were created
  namespace: default-tenant
spec:
  params:
  - name: git-url
    value: '{{source_url}}'
  - name: revision
    value: '{{revision}}'
  - name: output-image
    # Replace YOUR-ORG with your quay.io username or org
    # Must match the containerImage field in your Component CR (Phase 5)
    # The on-pr- prefix and short expiry mark this as a disposable PR image
    value: quay.io/YOUR-ORG/testrepo:on-pr-{{revision}}
  - name: image-expires-after
    value: 5d
  - name: dockerfile
    value: Dockerfile
  pipelineSpec:
    description: |
      Customized Konflux PR pipeline for testrepo. Extends the default minimal
      OCI trusted-artifacts pipeline with a custom `pr-build-summary` task.
      Key differences from the push pipeline:
        cancel-in-progress: true  — a new push to the same PR cancels the prior run
        image-expires-after: 5d   — PR images are disposable, not stored long-term
        skip-checks: false        — scans still run; set to "true" for faster PRs
    params:
    - description: Source Repository URL
      name: git-url
      type: string
    - default: ""
      description: Revision of the Source Repository
      name: revision
      type: string
    - description: Fully Qualified Output Image
      name: output-image
      type: string
    - default: .
      description: Path to the source code of an application's component from where
        to build image.
      name: path-context
      type: string
    - default: Dockerfile
      description: Path to the Dockerfile inside the context specified by parameter
        path-context
      name: dockerfile
      type: string
    - default: "false"
      description: Skip checks against built image
      name: skip-checks
      type: string
    - default: "false"
      description: Execute the build with network isolation
      name: hermetic
      type: string
    - default: ""
      description: Build dependencies to be prefetched
      name: prefetch-input
      type: string
    - default: ""
      description: Image tag expiration time, time values could be something like
        1h, 2d, 3w for hours, days, and weeks, respectively.
      name: image-expires-after
      type: string
    - default: "false"
      description: Add built image into an OCI image index
      name: build-image-index
      type: string
    - default: docker
      description: The format for the resulting image's mediaType. Valid values are
        oci or docker.
      name: buildah-format
      type: string
    - default: "false"
      description: Enable cache proxy configuration
      name: enable-cache-proxy
    - default: "true"
      description: Use the package registry proxy when prefetching dependencies
      name: enable-package-registry-proxy
    - default: .
      description: Target directories in component's source code to scan with SAST
        tools. Multiple values should be separated with commas.
      name: sast-target-dirs
      type: string
    - default: []
      description: Array of --build-arg values ("arg=value" strings) for buildah
      name: build-args
      type: array
    - default: ""
      description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file
      name: build-args-file
      type: string
    - default: "false"
      description: Whether to enable privileged mode, should be used only with remote
        VMs
      name: privileged-nested
      type: string
    results:
    - description: ""
      name: IMAGE_URL
      value: $(tasks.build-image-index.results.IMAGE_URL)
    - description: ""
      name: IMAGE_DIGEST
      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
    - description: ""
      name: CHAINS-GIT_URL
      value: $(tasks.clone-repository.results.url)
    - description: ""
      name: CHAINS-GIT_COMMIT
      value: $(tasks.clone-repository.results.commit)
    tasks:
    # ── DEFAULT TASKS (unchanged from the generated pipeline) ─────────────────
    - name: init
      params:
      - name: enable-cache-proxy
        value: $(params.enable-cache-proxy)
      taskRef:
        params:
        - name: name
          value: init
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db
        - name: kind
          value: task
        resolver: bundles
    - name: clone-repository
      params:
      - name: url
        value: $(params.git-url)
      - name: revision
        value: $(params.revision)
      - name: ociStorage
        value: $(params.output-image).git
      - name: ociArtifactExpiresAfter
        value: $(params.image-expires-after)
      runAfter:
      - init
      taskRef:
        params:
        - name: name
          value: git-clone-oci-ta-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.2@sha256:83bffb5ef4589830c8d0f606325fb27e8cd680c8404d5a935f6660174c9e118c
        - name: kind
          value: task
        resolver: bundles
      workspaces:
      - name: basic-auth
        workspace: git-auth
    - name: prefetch-dependencies
      params:
      - name: input
        value: $(params.prefetch-input)
      - name: enable-package-registry-proxy
        value: $(params.enable-package-registry-proxy)
      - name: SOURCE_ARTIFACT
        value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
      - name: ociStorage
        value: $(params.output-image).prefetch
      - name: ociArtifactExpiresAfter
        value: $(params.image-expires-after)
      runAfter:
      - clone-repository
      taskRef:
        params:
        - name: name
          value: prefetch-dependencies-oci-ta-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3.2@sha256:7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03
        - name: kind
          value: task
        resolver: bundles
      workspaces:
      - name: git-basic-auth
        workspace: git-auth
      - name: netrc
        workspace: netrc
    - name: build-container
      params:
      - name: IMAGE
        value: $(params.output-image)
      - name: DOCKERFILE
        value: $(params.dockerfile)
      - name: CONTEXT
        value: $(params.path-context)
      - name: HERMETIC
        value: $(params.hermetic)
      - name: PREFETCH_INPUT
        value: $(params.prefetch-input)
      - name: IMAGE_EXPIRES_AFTER
        value: $(params.image-expires-after)
      - name: COMMIT_SHA
        value: $(tasks.clone-repository.results.commit)
      - name: BUILD_ARGS
        value:
        - $(params.build-args[*])
      - name: BUILD_ARGS_FILE
        value: $(params.build-args-file)
      - name: PRIVILEGED_NESTED
        value: $(params.privileged-nested)
      - name: SOURCE_URL
        value: $(tasks.clone-repository.results.url)
      - name: BUILDAH_FORMAT
        value: $(params.buildah-format)
      - name: HTTP_PROXY
        value: $(tasks.init.results.http-proxy)
      - name: NO_PROXY
        value: $(tasks.init.results.no-proxy)
      - name: SOURCE_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
      - name: CACHI2_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
      runAfter:
      - prefetch-dependencies
      taskRef:
        params:
        - name: name
          value: buildah-oci-ta-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.10@sha256:72c599425e0bda63c30e10127dc493d139c75e45b986d8b7627a0d1b94aafff8
        - name: kind
          value: task
        resolver: bundles
    - name: build-image-index
      params:
      - name: IMAGE
        value: $(params.output-image)
      - name: ALWAYS_BUILD_INDEX
        value: $(params.build-image-index)
      - name: IMAGES
        value:
        - $(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST)
      - name: BUILDAH_FORMAT
        value: $(params.buildah-format)
      runAfter:
      - build-container
      taskRef:
        params:
        - name: name
          value: build-image-index-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:3279101e95f35b768877ae9e7620e92984bd72907e79ea5fefade39d56cc93a3
        - name: kind
          value: task
        resolver: bundles
    # ── CUSTOM TASK: pr-build-summary ────────────────────────────────────────
    # Demonstrates PR-specific pipeline customization. Runs after build-image-index
    # in parallel with the scan tasks. Notice the "on-pr-" prefix in the image tag
    # — this is set by the output-image param above and signals this is a throwaway
    # PR image, not a production artifact.
    #
    # Experiment: add a `when` condition (like the scan tasks) so this task only
    # runs when skip-checks is "true" (fast-PR mode). Flip the operator to "notin"
    # and the values to ["false"] — the structure is identical to the scan tasks.
    - name: pr-build-summary
      params:
      - name: IMAGE_URL
        value: $(tasks.build-image-index.results.IMAGE_URL)
      - name: IMAGE_DIGEST
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      - name: GIT_URL
        value: $(tasks.clone-repository.results.url)
      - name: GIT_COMMIT
        value: $(tasks.clone-repository.results.commit)
      - name: IMAGE_EXPIRES_AFTER
        value: $(params.image-expires-after)
      runAfter:
      - build-image-index
      taskSpec:
        params:
        - name: IMAGE_URL
          type: string
        - name: IMAGE_DIGEST
          type: string
        - name: GIT_URL
          type: string
        - name: GIT_COMMIT
          type: string
        - name: IMAGE_EXPIRES_AFTER
          type: string
        steps:
        - name: pr-summary
          image: registry.access.redhat.com/ubi9/ubi-minimal:latest
          script: |
            #!/bin/bash
            echo "=================================================="
            echo "          KONFLUX PR BUILD SUMMARY"
            echo "=================================================="
            printf '%-22s %s\n' "Source repository:"   "$(params.GIT_URL)"
            printf '%-22s %s\n' "PR commit:"           "$(params.GIT_COMMIT)"
            printf '%-22s %s\n' "PR image URL:"        "$(params.IMAGE_URL)"
            printf '%-22s %s\n' "Image digest:"        "$(params.IMAGE_DIGEST)"
            printf '%-22s %s\n' "Expires after:"       "$(params.IMAGE_EXPIRES_AFTER)"
            echo "=================================================="
            echo ""
            echo "NOTE: This is a disposable PR image. It expires in"
            echo "$(params.IMAGE_EXPIRES_AFTER) and will NOT be released."
            echo ""
            echo "Pull for local testing:"
            echo "  podman pull $(params.IMAGE_URL)@$(params.IMAGE_DIGEST)"
    # ── END CUSTOM TASK ───────────────────────────────────────────────────────
    - name: deprecated-base-image-check
      params:
      - name: IMAGE_URL
        value: $(tasks.build-image-index.results.IMAGE_URL)
      - name: IMAGE_DIGEST
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: deprecated-image-check
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    - name: clamav-scan
      params:
      - name: image-digest
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      - name: image-url
        value: $(tasks.build-image-index.results.IMAGE_URL)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: clamav-scan-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    - name: sast-shell-check
      params:
      - name: image-digest
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      - name: image-url
        value: $(tasks.build-image-index.results.IMAGE_URL)
      - name: TARGET_DIRS
        value: $(params.sast-target-dirs)
      - name: SOURCE_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
      - name: CACHI2_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: sast-shell-check-oci-ta-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    - name: sast-unicode-check
      params:
      - name: image-digest
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      - name: image-url
        value: $(tasks.build-image-index.results.IMAGE_URL)
      - name: TARGET_DIRS
        value: $(params.sast-target-dirs)
      - name: SOURCE_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
      - name: CACHI2_ARTIFACT
        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: sast-unicode-check-oci-ta-min
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    - name: rpms-signature-scan
      params:
      - name: image-url
        value: $(tasks.build-image-index.results.IMAGE_URL)
      - name: image-digest
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: rpms-signature-scan
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:65370ccb44ff82e4ce128addd913f3c96b298607b3760ee1339ed10011a4bd6b
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    - name: tpa-scan
      params:
      - name: image-digest
        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
      - name: image-url
        value: $(tasks.build-image-index.results.IMAGE_URL)
      runAfter:
      - build-image-index
      taskRef:
        params:
        - name: name
          value: tpa-scan
        - name: bundle
          value: quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e
        - name: kind
          value: task
        resolver: bundles
      when:
      - input: $(params.skip-checks)
        operator: in
        values:
        - "false"
    workspaces:
    - name: git-auth
      optional: true
    - name: netrc
      optional: true
  taskRunTemplate:
    # Auto-created by Build Service as build-pipeline-
    # For a component named "testrepo" this is automatically build-pipeline-testrepo
    serviceAccountName: build-pipeline-testrepo
  workspaces:
  - name: git-auth
    secret:
      secretName: '{{ git_auth_secret }}'
status: {}

# The inline taskSpec blocks in the two PipelineRun files above are convenient
# for one-off steps that only apply to a single pipeline. Once a task is stable
# and you want to share it across multiple pipelines, extract it to a standalone
# Tekton Task CRD like this one.
#
# After applying this Task to your namespace, reference it from any PipelineRun:
#
#   - name: print-build-summary
#     taskRef:
#       name: print-build-summary       # resolves by name in the same namespace
#     params:
#     - name: IMAGE_URL
#       value: $(tasks.build-image-index.results.IMAGE_URL)
#     - name: IMAGE_DIGEST
#       value: $(tasks.build-image-index.results.IMAGE_DIGEST)
#     - name: GIT_URL
#       value: $(tasks.clone-repository.results.url)
#     - name: GIT_COMMIT
#       value: $(tasks.clone-repository.results.commit)
#     runAfter:
#     - build-image-index
#
# Apply to your tenant namespace:
#   oc apply -f .tekton/tasks/print-build-summary.yaml -n default-tenant
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: print-build-summary
  namespace: default-tenant
  annotations:
    tekton.dev/displayName: "Print Build Summary"
    tekton.dev/tags: "notification, summary, debugging"
spec:
  description: >-
    Prints a human-readable summary of a completed Konflux build including
    the image URL, digest, and source commit. Use this as a template for
    custom notification steps (Slack, PagerDuty, JIRA webhooks, etc.) —
    replace the echo statements with your notification tool of choice.
  params:
    - name: IMAGE_URL
      type: string
      description: "Fully qualified image URL from build-image-index.results.IMAGE_URL"
    - name: IMAGE_DIGEST
      type: string
      description: "Image digest (sha256:...) from build-image-index.results.IMAGE_DIGEST"
    - name: GIT_URL
      type: string
      description: "Source repository URL from clone-repository.results.url"
    - name: GIT_COMMIT
      type: string
      description: "Git commit SHA from clone-repository.results.commit"
  results:
    - name: SUMMARY
      description: "One-line summary — useful as input to downstream notification tasks"
  steps:
    - name: summarize
      image: registry.access.redhat.com/ubi9/ubi-minimal:latest
      script: |
        #!/bin/bash
        echo "=================================================="
        echo "           KONFLUX BUILD SUMMARY"
        echo "=================================================="
        printf '%-22s %s\n' "Source repository:"  "$(params.GIT_URL)"
        printf '%-22s %s\n' "Git commit:"         "$(params.GIT_COMMIT)"
        printf '%-22s %s\n' "Built image URL:"    "$(params.IMAGE_URL)"
        printf '%-22s %s\n' "Image digest:"       "$(params.IMAGE_DIGEST)"
        echo "=================================================="
        echo ""
        echo "Pull the image:"
        echo "  podman pull $(params.IMAGE_URL)@$(params.IMAGE_DIGEST)"
        echo ""
        echo "Verify the signature (Tekton Chains signs after PipelineRun completes):"
        echo "  cosign verify --key cosign.pub --insecure-ignore-tlog \\"
        echo "    $(params.IMAGE_URL)@$(params.IMAGE_DIGEST)"
        echo ""
        # Write a one-liner result for downstream tasks (e.g. a Slack notifier task)
        SUMMARY="Built $(params.IMAGE_URL)@$(params.IMAGE_DIGEST) from $(params.GIT_COMMIT)"
        printf '%s' "$SUMMARY" | tee "$(results.SUMMARY.path)"

# ── PREREQUISITE 1: RBAC for konflux-integration-runner ──────────────────────
#
# WHY THIS IS NEEDED:
# The integration test pipeline (testrepo-integration.yaml) creates a Kubernetes
# Job in the tenant namespace to run the built container image, then reads its logs.
# By default the konflux-integration-runner service account only has narrow
# permissions and cannot create, delete, or list batch/jobs or pod logs in
# the tenant namespace. Without this RBAC the test PipelineRun fails immediately:
#
#   Error from server (Forbidden): jobs.batch "test-hello" is forbidden:
#   User "system:serviceaccount:default-tenant:konflux-integration-runner"
#   cannot delete resource "jobs" in API group "batch" in the namespace "default-tenant"
#
# This is a known gap in the standard Konflux install — the same Role+RoleBinding
# pattern is used in the official Konflux e2e test fixtures:
#   https://github.com/konflux-ci/konflux-ci/blob/main/test/resources/demo-users/user/ns2/appstudio-pipeline-integration-runner-rbac.yaml
#
# Apply this once before creating the IntegrationTestScenario:
#   oc apply -f integration-runner-rbac.yaml
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  # Must match your tenant namespace
  namespace: default-tenant
  name: default-tenant-pod-viewer-job-creator
rules:
- apiGroups: [""]
  resources:
    - pods
  verbs: ["get", "list", "watch", "delete"]
- apiGroups: ["batch"]
  resources:
    - jobs
  verbs: ["create", "delete", "get", "list", "watch"]
- apiGroups: [""]
  resources:
    - pods/log
  verbs: ["get", "list"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  # Must match your tenant namespace
  namespace: default-tenant
  name: default-tenant-pod-viewer-job-creator-binding
subjects:
# Grants the job viewer/creator permissions to konflux-integration-runner
# which is the SA Konflux uses to run integration test PipelineRuns
- kind: ServiceAccount
  name: konflux-integration-runner
  namespace: default-tenant
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: default-tenant-pod-viewer-job-creator

# WHY THIS IS NEEDED:
# The Kubernetes Job created by the test pipeline runs as the "default" service
# account in default-tenant. The regcred secret (your quay.io push/pull credentials
# created in Phase 4) must be explicitly linked to this SA or the Job pod will
# fail to pull the testrepo image with an image pull error:
#
#   Failed to pull image "quay.io/...": ...unauthorized: access to the requested
#   resource is not authorized

# Link regcred to the default service account in your tenant namespace
oc secrets link default regcred --for=pull -n default-tenant

# Verify the link was applied — output must include {"name": "regcred"}
oc get sa default -n default-tenant \
  -o jsonpath='{.imagePullSecrets}' | python3 -m json.tool

apiVersion: appstudio.redhat.com/v1beta2
kind: IntegrationTestScenario
metadata:
  # Name for this test scenario — shown in the Konflux UI test results panel
  name: testrepo-integration-tests
  # Must match your tenant namespace — where the Application and Component CRs live
  namespace: default-tenant
  labels:
    test.appstudio.openshift.io/optional: "false"   # failure blocks release
spec:
  # Must match the Application CR name created in Phase 5
  application: my-first-app

  # Points to the integration test pipeline inside your git repository.
  # The Integration Service resolves this file at test time using the git
  # resolver — no need to apply the pipeline to the cluster separately.
  resolverRef:
    resolver: git
    params:
      - name: url
        # Replace YOUR-USERNAME with your GitHub username (owner of the testrepo fork)
        value: https://github.com/YOUR-USERNAME/testrepo
      - name: revision
        value: main
      - name: pathInRepo
        # Path to the test pipeline file inside the repository
        # This file already exists in the testrepo — do not rename it
        value: integration-tests/testrepo-integration.yaml

# Konflux integration test for testrepo.
# Runs the built container image as a Kubernetes Job and asserts its logs
# contain "hello world" — the output produced by entrypoint.sh.
#
# This file is already present in the testrepo repository at:
#   integration-tests/testrepo-integration.yaml
#
# The IntegrationTestScenario (integration-test-scenario.yaml) points the
# Integration Service here via the git resolver, so this pipeline is fetched
# from the repo at test time. You do NOT apply it manually to the cluster.
#
# IMPORTANT: Keep the grep assertion ("hello world") in sync with entrypoint.sh.
# If you change what entrypoint.sh prints, update the grep below too.
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: testrepo-integration-test
spec:
  params:
    - name: SNAPSHOT
      type: string
      description: |
        JSON snapshot injected by the Konflux Integration Service.
        Contains the built image reference for the testrepo component:
          {
            "components": [
              {
                "containerImage": "quay.io/YOUR-ORG/testrepo@sha256:..."
              }
            ]
          }
  tasks:
    - name: test-hello-world
      params:
        - name: SNAPSHOT
          value: "$(params.SNAPSHOT)"
      taskSpec:
        params:
          - name: SNAPSHOT
            type: string
        steps:
          - name: test-output
            # oc image with jq — resolves the image from the snapshot and
            # runs it as a Job to verify the container prints "hello world"
            image: quay.io/ongres/kubectl@sha256:4be5050c456a4751fe3d70086c0387d65e8973a176fe965de4eaeeb8643b2e0a
            env:
              - name: SNAPSHOT
                value: "$(params.SNAPSHOT)"
              - name: NAMESPACE
                # Injected automatically by Tekton — the namespace the PipelineRun runs in
                value: "$(context.pipelineRun.namespace)"
            script: |
              #!/usr/bin/bash
              set -euxo pipefail

              # Extract the built image from the snapshot (first component)
              IMAGE=$(echo "$SNAPSHOT" | jq -r '.components[0].containerImage')
              echo "Extracted image: $IMAGE"

              # Clean up any leftover job or pods from a previous run
              kubectl delete job --ignore-not-found test-hello -n $NAMESPACE
              kubectl delete pods --ignore-not-found -l job-name=test-hello -n $NAMESPACE

              # Run the testrepo image as a short-lived Job
              kubectl create job test-hello -n $NAMESPACE --image=$IMAGE

              # Wait up to 120s for the Job to complete (entrypoint.sh exits after printing)
              kubectl wait --for=condition=complete job/test-hello --timeout=120s

              # Capture the pod logs and assert the expected output
              LOGS=$(kubectl logs -l job-name=test-hello -n $NAMESPACE)

              # Clean up the Job after capturing logs
              kubectl delete job --ignore-not-found test-hello -n $NAMESPACE

              # This is the actual test assertion — fails the pipeline if output is wrong
              echo $LOGS | grep "hello world"

apiVersion: appstudio.redhat.com/v1alpha1
kind: Snapshot
metadata:
  # A descriptive name for this manually created snapshot
  name: testrepo-manual-snapshot
  # Must match your tenant namespace
  namespace: default-tenant
  labels:
    # Must match the Application CR name created in Phase 5
    appstudio.openshift.io/application: my-first-app
    # "override" marks this as a manually created snapshot (not from a build)
    test.appstudio.openshift.io/type: override
spec:
  # Must match the Application CR name created in Phase 5
  application: my-first-app
  displayName: "Manual test snapshot for integration test development"
  components:
    # Must match the Component CR name created in Phase 5
    - name: testrepo
      # Replace with the actual image digest from a previous successful push build.
      # Get the image URL and digest from the last push PipelineRun:
      #   NS="default-tenant"
      #   PR=$(oc get pipelinerun -n $NS --sort-by=.metadata.creationTimestamp \
      #          -o jsonpath='{.items[-1].metadata.name}')
      #   oc get pipelinerun $PR -n $NS \
      #     -o jsonpath='{.status.results[?(@.name=="IMAGE_URL")].value}'
      #   oc get pipelinerun $PR -n $NS \
      #     -o jsonpath='{.status.results[?(@.name=="IMAGE_DIGEST")].value}'
      # Then combine as: quay.io/YOUR-ORG/testrepo@sha256:
      containerImage: quay.io/YOUR-ORG/testrepo@sha256:abc123def456abc123def456abc123def456abc123def456abc123def456abc123

# The ReleasePlanAdmission references this policy by name. If this CR does not
# exist, every Release fails immediately with:
#   EnterpriseContractPolicy.appstudio.redhat.com "testrepo-ec-policy" not found
#
# This policy mirrors the cluster-managed default from enterprise-contract-service/default,
# applied in default-tenant so the release pipeline can reference it via
# "default-tenant/testrepo-ec-policy" without cross-namespace access.
# It enforces the @redhat collection (excluding hermetic_task, source_image, rpm_repos)
# using the same pinned policy and data bundles as the cluster default.
#
# ── ALTERNATIVE: create directly from the cluster default (no YAML file needed) ──
# Instead of applying this file, you can copy the default policy from the
# enterprise-contract-service namespace and apply it to default-tenant in one command:
#
#   oc get enterprisecontractpolicy default \
#     -n enterprise-contract-service \
#     -o json \
#     | jq 'del(.metadata.resourceVersion,
#               .metadata.uid,
#               .metadata.creationTimestamp,
#               .metadata.generation,
#               .metadata.ownerReferences,
#               .metadata.labels,
#               .metadata.managedFields,
#               .status)
#           | .metadata.name = "testrepo-ec-policy"
#           | .metadata.namespace = "default-tenant"' \
#     | oc apply -f -
#
#   # Verify it was created
#   oc get enterprisecontractpolicy testrepo-ec-policy -n default-tenant
apiVersion: appstudio.redhat.com/v1alpha1
kind: EnterpriseContractPolicy
metadata:
  name: testrepo-ec-policy
  # Must match the namespace where the ReleasePlanAdmission lives
  namespace: default-tenant
spec:
  description: >-
    Mirror of the cluster default EnterpriseContractPolicy from
    enterprise-contract-service/default, applied in default-tenant for the
    testrepo release pipeline. Enforces the @redhat rule collection with the
    same exclusions and pinned bundle references as the cluster-managed policy.
    Omit ownerReferences — this CR is managed manually, not by the operator.
  name: Default
  # Public key used to verify Tekton Chains image signatures.
  # References the cosign.pub key in openshift-pipelines/public-key secret.
  # Extract with: oc get secret public-key -n openshift-pipelines \
  #                 -o jsonpath='{.data.cosign\.pub}' | base64 -d
  publicKey: k8s://openshift-pipelines/public-key
  sources:
    - name: Default
      config:
        exclude:
          - hermetic_task
          - source_image
          - rpm_repos
        include:
          - '@redhat'
      data:
        - oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest@sha256:1d39bdf428eb0273938d672ae9d65c26e42aad64db106ed643e685ce14b09e69
        - github.com/redhat-appstudio/tsf-conforma-data//data?ref=1966f21842d507441a7a5e1c7de9071cf3f9ec53
      policy:
        - oci::quay.io/conforma/release-policy:latest@sha256:4b56dc3d04f3dd372b1db1b38fa02ef8bad0799f354de0c011ac5eba106e0541

apiVersion: appstudio.redhat.com/v1alpha1
kind: ReleasePlan
metadata:
  # Conventionally -release-plan
  name: testrepo-release-plan
  # Must match your tenant namespace
  namespace: default-tenant
  labels:
    # "false" = manual release: you create a Release object yourself
    # "true"  = auto-release: Integration Service creates a Release on every passing Snapshot
    release.appstudio.openshift.io/auto-release: "true"
    # REQUIRED for auto-release — tells the Release Service who authorises automated releases.
    # "standing-attribution: true" means: attribute every automated Release to whoever
    # created this ReleasePlan (no hardcoded username needed).
    # Without this label, automated releases fail with:
    #   "no author in the ReleasePlan found for automated release"
    # Safe to include even when auto-release is "false" — it has no effect for manual releases.
    release.appstudio.openshift.io/standing-attribution: "true"
spec:
  # Must match the Application CR name created in Phase 5
  application: my-first-app

  # The namespace where the ReleasePlanAdmission lives.
  # For this learning setup both the ReleasePlan and ReleasePlanAdmission live
  # in the same default-tenant namespace — no separate managed namespace needed.
  target: default-tenant

  # Snapshot must have passed integration tests within this many days to be releasable
  releaseGracePeriodDays: 7

apiVersion: appstudio.redhat.com/v1alpha1
kind: ReleasePlanAdmission
metadata:
  # Conventionally -admission
  name: testrepo-admission
  # Same namespace as the ReleasePlan — no separate managed namespace for this learning setup
  namespace: default-tenant
spec:
  # Must match the namespace where the ReleasePlan lives
  origin: default-tenant

  # Must match the Application CR name created in Phase 5
  applications:
    - my-first-app

  # The Tekton pipeline to run when a Release is triggered.
  # The git resolver fetches the pipeline from the repo at release time —
  # no need to apply it to the cluster separately.
  pipeline:
    pipelineRef:
      resolver: git
      params:
        - name: url
          # Replace YOUR-USERNAME with your GitHub username (owner of the testrepo fork).
          # In production this would typically be a dedicated release-pipelines repository.
          value: https://github.com/YOUR-USERNAME/testrepo
        - name: revision
          value: main
        - name: pathInRepo
          # Path to the release pipeline inside the repository
          value: release/release-pipeline.yaml

  # EnterpriseContractPolicy to enforce before the release pipeline runs.
  # The CR must exist in the managed namespace before a Release is triggered.
  # See enterprise-contract-policy.yaml below for how to create it.
  policy: testrepo-ec-policy

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: testrepo-release-to-staging
  namespace: default-tenant
spec:
  description: >-
    Production release pipeline for testrepo.
    Validates the built image with Enterprise Contract (Conforma) then promotes
    it to the staging registry. Registry credentials come from the regcred secret
    (kubernetes.io/dockerconfigjson) mounted as a projected volume — this bypasses
    Tekton cred-init and provides stable credentials to all OCI tools (skopeo,
    cosign, ec) regardless of the step user identity.
  params:
    - name: release
      type: string
      description: "The Release CRD name — injected by the Release Service"
    - name: releasePlan
      type: string
      description: "The ReleasePlan CRD name"
    - name: releasePlanAdmission
      type: string
      description: "The ReleasePlanAdmission CRD name"
    - name: snapshot
      type: string
      description: "Snapshot reference — injected by the Release Service as namespace/name"
    - name: enterpriseContractPolicy
      type: string
      description: "Enterprise Contract policy name (not used directly — policy is hardcoded below)"

  tasks:

    # ── Task 1: Extract the image reference from the Snapshot ─────────────────
    # The Release Service passes snapshot as "namespace/name" (e.g.
    # "default-tenant/my-first-app-abc123"). This task fetches the Snapshot CR
    # from the cluster and extracts the containerImage for the testrepo component.
    - name: extract-images
      taskSpec:
        params:
          - name: snapshot
        results:
          - name: image
            description: "containerImage for the testrepo component"
        steps:
          - name: extract
            image: quay.io/ongres/kubectl@sha256:4be5050c456a4751fe3d70086c0387d65e8973a176fe965de4eaeeb8643b2e0a
            env:
              - name: SNAPSHOT_REF
                value: "$(params.snapshot)"
            script: |
              #!/bin/bash
              set -e

              echo "Snapshot reference: $SNAPSHOT_REF"

              if [[ "$SNAPSHOT_REF" == *"/"* ]]; then
                SNAP_NS="${SNAPSHOT_REF%%/*}"
                SNAP_NAME="${SNAPSHOT_REF##*/}"
              else
                SNAP_NS="default-tenant"
                SNAP_NAME="$SNAPSHOT_REF"
              fi

              echo "Fetching snapshot '$SNAP_NAME' from namespace '$SNAP_NS'"

              IMAGE=$(kubectl get snapshot "$SNAP_NAME" -n "$SNAP_NS" -o json | \
                jq -r '.spec.components[] | select(.name=="testrepo") | .containerImage')

              if [ -z "$IMAGE" ] || [ "$IMAGE" = "null" ]; then
                echo "ERROR: component 'testrepo' not found in snapshot" >&2
                kubectl get snapshot "$SNAP_NAME" -n "$SNAP_NS" -o yaml >&2
                exit 1
              fi

              echo "Extracted image: $IMAGE"
              printf '%s' "$IMAGE" > $(results.image.path)
      params:
        - name: snapshot
          value: "$(params.snapshot)"

    # ── Task 2: Enterprise Contract validation ────────────────────────────────
    # Runs ec validate image against the Enterprise Contract policy.
    #
    # Credential approach (projected volume):
    #   regcred (.dockerconfigjson) is mounted as /var/docker-config/config.json
    #   via a projected volume and DOCKER_CONFIG is set to that directory.
    #   This gives all tools (ec, cosign) stable access to registry credentials
    #   regardless of which user the step runs as — avoids the Tekton cred-init
    #   permission race that causes "permission denied on /tekton/home/.docker/config.json".
    #
    # Tekton cred-init permission fix:
    #   The write-snapshot step (first to run) pre-creates /tekton/home/.docker/
    #   and sets it to mode 777 so every subsequent step's cred-init can write
    #   its copy of credentials without hitting permission denied.
    #
    # Policy: enterprise-contract-service/default
    #   Uses the @redhat collection (excluding hermetic_task, source_image, rpm_repos).
    #   Note: slsa_source_correlated rules will produce a violation because satisfying
    #   them requires EC config files in the source repository at the exact build commit.
    #   STRICT is set to false so the violation is reported but does not block the release.
    #   Set STRICT to true after adding EC config to your source repo.
    #
    # IGNORE_REKOR: true
    #   Required on self-hosted Konflux — images are signed by Tekton Chains using
    #   the cluster's internal cosign key. No entry is written to the public
    #   Sigstore Rekor at rekor.sigstore.dev.
    - name: validate-enterprise-contract
      runAfter:
        - extract-images
      taskSpec:
        params:
          - name: image
            type: string
          - name: POLICY_CONFIGURATION
            type: string
            default: "enterprise-contract-service/default"
          - name: PUBLIC_KEY
            type: string
            default: "k8s://openshift-pipelines/public-key"
          - name: IGNORE_REKOR
            type: string
            default: "true"
          - name: STRICT
            type: string
            default: "false"
          - name: WORKERS
            type: string
            default: "4"
        results:
          - name: TEST_OUTPUT
            description: "EC policy evaluation result — SUCCESS, WARNING, or FAILURE"
        volumes:
          - name: workdir
            emptyDir: {}
          - name: trusted-ca
            configMap:
              name: trusted-ca
              items:
                - key: ca-bundle.crt
                  path: ca-bundle.crt
              optional: true
          - name: docker-config
            projected:
              sources:
                - secret:
                    name: regcred
                    items:
                      - key: .dockerconfigjson
                        path: config.json
        stepTemplate:
          volumeMounts:
            - mountPath: /var/workdir
              name: workdir
            - mountPath: /mnt/trusted-ca
              name: trusted-ca
              readOnly: true
            - mountPath: /var/docker-config
              name: docker-config
              readOnly: true
          env:
            - name: HOME
              value: /tekton/home
            - name: DOCKER_CONFIG
              value: /var/docker-config

        steps:
          # Step 1: Write snapshot JSON and fix Tekton cred-init directory permissions.
          # Creates /tekton/home/.docker/ with mode 777 so all subsequent steps'
          # cred-init can write their credentials copy without permission denied errors.
          - name: write-snapshot
            image: registry.access.redhat.com/ubi9/ubi-minimal:latest
            env:
              - name: IMAGE
                value: "$(params.image)"
            script: |
              #!/bin/bash
              set -euo pipefail

              # Write the snapshot JSON for ec validate image
              mkdir -p /var/workdir
              printf '%s' \
                "{\"components\":[{\"name\":\"testrepo\",\"containerImage\":\"$IMAGE\"}]}" \
                > /var/workdir/snapshot.json
              echo "snapshot.json:"
              cat /var/workdir/snapshot.json

              # Fix Tekton cred-init directory permissions.
              # Cred-init runs before each step's script and tries to write
              # /tekton/home/.docker/config.json. If this directory was created
              # by a previous step as root (mode 700), subsequent non-root steps
              # get "permission denied". Setting mode 777 on the directory (and
              # 666 on the file if it already exists) lets every step's cred-init
              # succeed without errors.
              mkdir -p /tekton/home/.docker
              chmod 777 /tekton/home/.docker
              if [ -f /tekton/home/.docker/config.json ]; then
                chmod 666 /tekton/home/.docker/config.json
              fi

          # Step 2: Skip TUF — cluster uses internal Tekton Chains key, not public Sigstore
          - name: initialize-tuf
            image: quay.io/conforma/cli:latest
            script: |
              echo 'TUF_MIRROR not configured — skipping TUF root initialization.'

          # Step 3: Enterprise Contract validation.
          # WHY --strict=false in the ec command:
          #   ec always exits 0 and writes all output files (TEST_OUTPUT, text report,
          #   JSON report) even when violations exist. This ensures every subsequent
          #   step (detailed-report, summary, version) has the data it needs for the
          #   audit trail. The actual release-blocking decision is made by the assert
          #   step, which reads TEST_OUTPUT and honours the STRICT param.
          - name: validate
            image: quay.io/conforma/cli:latest
            onError: continue
            env:
              - name: POLICY_CONFIGURATION
                value: "$(params.POLICY_CONFIGURATION)"
              - name: PUBLIC_KEY
                value: "$(params.PUBLIC_KEY)"
              - name: IGNORE_REKOR
                value: "$(params.IGNORE_REKOR)"
              - name: WORKERS
                value: "$(params.WORKERS)"
            script: |
              #!/bin/bash
              set -euo pipefail

              if [ -f "/mnt/trusted-ca/ca-bundle.crt" ]; then
                export SSL_CERT_FILE="/mnt/trusted-ca/ca-bundle.crt"
              fi

              ec validate image \
                --images=/var/workdir/snapshot.json \
                --policy="${POLICY_CONFIGURATION}" \
                --public-key="${PUBLIC_KEY}" \
                --ignore-rekor="${IGNORE_REKOR}" \
                --workers="${WORKERS}" \
                --strict=false \
                --info=true \
                --timeout=0 \
                --output="text=/var/workdir/text-report.txt?show-successes=false" \
                --output="json=/var/workdir/report-json.json" \
                --output="appstudio=$(results.TEST_OUTPUT.path)"

          # Step 4: Human-readable EC report (violations and warnings only)
          - name: detailed-report
            image: quay.io/conforma/cli:latest
            onError: continue
            command: ["cat"]
            args: ["/var/workdir/text-report.txt"]

          # Step 5: TEST_OUTPUT summary (SUCCESS / WARNING / FAILURE + counts)
          - name: summary
            image: quay.io/conforma/cli:latest
            onError: continue
            command: ["jq"]
            args: [".", "$(results.TEST_OUTPUT.path)"]

          # Step 6: ec version — recorded for reproducibility and audit
          - name: version
            image: quay.io/conforma/cli:latest
            command: ["ec"]
            args: ["version"]

          # Step 7: Assert.
          # With STRICT=false: always exits 0 — pipeline continues regardless of violations.
          # With STRICT=true:  exits non-zero if result is FAILURE — pipeline and release blocked.
          # Change STRICT param to "true" once all EC rules pass cleanly.
          - name: assert
            image: quay.io/conforma/cli:latest
            env:
              - name: STRICT
                value: "$(params.STRICT)"
            command: ["jq"]
            args:
              - "--argjson"
              - "strict"
              - "$(params.STRICT)"
              - "-e"
              - '.result == "SUCCESS" or .result == "WARNING" or ($strict | not)'
              - "$(results.TEST_OUTPUT.path)"
      params:
        - name: image
          value: "$(tasks.extract-images.results.image)"
        - name: POLICY_CONFIGURATION
          value: "enterprise-contract-service/default"
        - name: PUBLIC_KEY
          value: "k8s://openshift-pipelines/public-key"
        - name: IGNORE_REKOR
          value: "true"
        - name: STRICT
          value: "false"

    # ── Task 3: Push the released image to the staging registry ───────────────
    # Runs only after EC validation completes (STRICT=false means it always runs;
    # set STRICT=true to block here on violations).
    # Uses skopeo with regcred credentials written inline to /tmp/auth/config.json.
    - name: push-to-staging-registry
      runAfter:
        - validate-enterprise-contract
      taskSpec:
        params:
          - name: source-image
            type: string
          - name: target-registry
            type: string
            # Replace YOUR-ORG with your staging quay.io org/username
            default: "quay.io/YOUR-ORG"
        steps:
          - name: copy-image
            image: quay.io/skopeo/stable:latest
            env:
              - name: SOURCE
                value: "$(params.source-image)"
              - name: TARGET
                value: "$(params.target-registry)/testrepo:latest"
              - name: DOCKER_CONFIG_JSON
                valueFrom:
                  secretKeyRef:
                    name: regcred
                    key: .dockerconfigjson
            script: |
              #!/bin/bash
              set -e
              mkdir -p /tmp/auth
              printf '%s' "$DOCKER_CONFIG_JSON" > /tmp/auth/config.json
              echo "Copying: $SOURCE → $TARGET"
              skopeo copy \
                --authfile /tmp/auth/config.json \
                "docker://$SOURCE" \
                "docker://$TARGET"
              echo "Image pushed to staging registry."
              rm -f /tmp/auth/config.json
      params:
        - name: source-image
          value: "$(tasks.extract-images.results.image)"

    # ── Task 4: Tag the released image as stable ──────────────────────────────
    - name: post-release-actions
      runAfter:
        - push-to-staging-registry
      taskSpec:
        params:
          - name: image
            type: string
          - name: release-name
            type: string
          - name: target-registry
            type: string
            # Replace YOUR-ORG with your staging quay.io org/username
            default: "quay.io/YOUR-ORG"
        steps:
          - name: tag-stable
            image: quay.io/skopeo/stable:latest
            env:
              - name: IMAGE
                value: "$(params.image)"
              - name: RELEASE
                value: "$(params.release-name)"
              - name: TARGET_REGISTRY
                value: "$(params.target-registry)"
              - name: DOCKER_CONFIG_JSON
                valueFrom:
                  secretKeyRef:
                    name: regcred
                    key: .dockerconfigjson
            script: |
              #!/bin/bash
              set -e

              mkdir -p /tmp/auth
              printf '%s' "$DOCKER_CONFIG_JSON" > /tmp/auth/config.json

              echo "=================================================="
              echo "           RELEASE SUMMARY"
              echo "=================================================="
              echo "Release name   : $RELEASE"
              echo "Released image : $IMAGE"
              echo "=================================================="

              STABLE_TAG="$TARGET_REGISTRY/testrepo:stable"
              echo ""
              echo "Tagging as stable: $STABLE_TAG"
              skopeo copy \
                --authfile /tmp/auth/config.json \
                "docker://$IMAGE" \
                "docker://$STABLE_TAG"
              echo "Stable tag updated."
              rm -f /tmp/auth/config.json
      params:
        - name: image
          value: "$(tasks.extract-images.results.image)"
        - name: release-name
          value: "$(params.release)"
        - name: target-registry
          value: "quay.io/YOUR-ORG"

apiVersion: appstudio.redhat.com/v1alpha1
kind: Release
metadata:
  # Give each release a unique, descriptive name
  name: testrepo-release-v1
  # Must match your tenant namespace
  namespace: default-tenant
spec:
  # The Snapshot to release — must have passed all integration tests.
  # Get the name of the LATEST passing Snapshot (sort by creationTimestamp descending):
  #   oc get snapshot -n default-tenant -o json | \
  #     jq -r '[.items[] | select(.status.conditions // [] | any(.type == "AppStudioTestSucceeded" and .status == "True"))] | sort_by(.metadata.creationTimestamp) | reverse | .[0].metadata.name'
  snapshot: testrepo-manual-snapshot

  # Must match the ReleasePlan name in release-plan.yaml
  releasePlan: testrepo-release-plan

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  annotations:
    # Replace YOUR-USERNAME with your GitHub username (owner of your testrepo fork)
    build.appstudio.openshift.io/repo: https://github.com/YOUR-USERNAME/testrepo?rev={{revision}}
    build.appstudio.redhat.com/commit_sha: '{{revision}}'
    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
    pipelinesascode.tekton.dev/cancel-in-progress: "false"
    pipelinesascode.tekton.dev/max-keep-runs: "3"
    pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "main"
  labels:
    # Must match the Application and Component CRs created in item 14
    appstudio.openshift.io/application: my-first-app
    appstudio.openshift.io/component: testrepo
    pipelines.appstudio.openshift.io/type: build
  name: testrepo-multiarch-on-push
  namespace: default-tenant
spec:
  params:
  - name: git-url
    value: '{{source_url}}'
  - name: revision
    value: '{{revision}}'
  # Replace YOUR-ORG with your quay.io username or org
  # Must match the containerImage field in your Component CR
  - name: output-image
    value: quay.io/YOUR-ORG/testrepo:{{revision}}
  - name: dockerfile
    value: Dockerfile
  # ── The key addition: build-platforms ────────────────────────────────────────
  # Tekton Matrix fans out one build-container TaskRun per entry, all running
  # in parallel. The per-arch images are then merged into a single OCI Image Index.
  - name: build-platforms
    value:
    - linux/amd64
    - linux/arm64
    - linux/s390x
  pipelineRef:
    # Switch from the standard docker-build bundle to the multi-platform variant.
    # This bundle is a COMPLETE pipeline — it includes all standard Konflux tasks
    # (init, clone, SAST, Clair scan, ClamAV, EC scan, apply-tags, push-dockerfile)
    # plus the Tekton Matrix that fans out build-images per platform and the
    # build-image-index task that merges per-arch digests into an OCI Image Index.
    # No checks from the original testrepo-push.yaml are lost by switching here.
    resolver: bundles
    params:
    - name: bundle
      value: quay.io/konflux-ci/tekton-catalog/pipeline-docker-build-multi-platform-oci-ta@sha256:17a3c94c33742e19f35c2516bbd7fab4ed702838c7a6d47daea70100d350e266
    - name: name
      value: docker-build-multi-platform-oci-ta
    - name: kind
      value: pipeline
  taskRunTemplate:
    serviceAccountName: build-pipeline-testrepo
  workspaces:
  - name: git-auth
    secret:
      secretName: '{{ git_auth_secret }}'
status: {}

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: testrepo-release-to-staging
  namespace: default-tenant
spec:
  description: >-
    Production release pipeline for testrepo.
    Validates the built image with Enterprise Contract (Conforma) then promotes
    it to the staging registry. Registry credentials come from the regcred secret
    (kubernetes.io/dockerconfigjson) mounted as a projected volume — this bypasses
    Tekton cred-init and provides stable credentials to all OCI tools (skopeo,
    cosign, ec) regardless of the step user identity.
  params:
    - name: release
      type: string
      description: "The Release CRD name — injected by the Release Service"
    - name: releasePlan
      type: string
      description: "The ReleasePlan CRD name"
    - name: releasePlanAdmission
      type: string
      description: "The ReleasePlanAdmission CRD name"
    - name: snapshot
      type: string
      description: "Snapshot reference — injected by the Release Service as namespace/name"
    - name: enterpriseContractPolicy
      type: string
      description: "Enterprise Contract policy name (not used directly — policy is hardcoded below)"

  tasks:

    # ── Task 1: Extract the image reference from the Snapshot ─────────────────
    # The Release Service passes snapshot as "namespace/name" (e.g.
    # "default-tenant/my-first-app-abc123"). This task fetches the Snapshot CR
    # from the cluster and extracts the containerImage for the testrepo component.
    # For a multi-arch build the containerImage is the OCI Image Index digest —
    # skopeo copy in Task 3 handles manifest lists transparently.
    - name: extract-images
      taskSpec:
        params:
          - name: snapshot
        results:
          - name: image
            description: "containerImage for the testrepo component"
        steps:
          - name: extract
            image: quay.io/ongres/kubectl@sha256:4be5050c456a4751fe3d70086c0387d65e8973a176fe965de4eaeeb8643b2e0a
            env:
              - name: SNAPSHOT_REF
                value: "$(params.snapshot)"
            script: |
              #!/bin/bash
              set -e

              echo "Snapshot reference: $SNAPSHOT_REF"

              if [[ "$SNAPSHOT_REF" == *"/"* ]]; then
                SNAP_NS="${SNAPSHOT_REF%%/*}"
                SNAP_NAME="${SNAPSHOT_REF##*/}"
              else
                SNAP_NS="default-tenant"
                SNAP_NAME="$SNAPSHOT_REF"
              fi

              echo "Fetching snapshot '$SNAP_NAME' from namespace '$SNAP_NS'"

              IMAGE=$(kubectl get snapshot "$SNAP_NAME" -n "$SNAP_NS" -o json | \
                jq -r '.spec.components[] | select(.name=="testrepo") | .containerImage')

              if [ -z "$IMAGE" ] || [ "$IMAGE" = "null" ]; then
                echo "ERROR: component 'testrepo' not found in snapshot" >&2
                kubectl get snapshot "$SNAP_NAME" -n "$SNAP_NS" -o yaml >&2
                exit 1
              fi

              echo "Extracted image: $IMAGE"
              printf '%s' "$IMAGE" > $(results.image.path)
      params:
        - name: snapshot
          value: "$(params.snapshot)"

    # ── Task 2: Enterprise Contract validation ────────────────────────────────
    - name: validate-enterprise-contract
      runAfter:
        - extract-images
      taskSpec:
        params:
          - name: image
            type: string
          - name: POLICY_CONFIGURATION
            type: string
            default: "enterprise-contract-service/default"
          - name: PUBLIC_KEY
            type: string
            default: "k8s://openshift-pipelines/public-key"
          - name: IGNORE_REKOR
            type: string
            default: "true"
          - name: STRICT
            type: string
            default: "false"
          - name: WORKERS
            type: string
            default: "4"
        results:
          - name: TEST_OUTPUT
            description: "EC policy evaluation result — SUCCESS, WARNING, or FAILURE"
        volumes:
          - name: workdir
            emptyDir: {}
          - name: trusted-ca
            configMap:
              name: trusted-ca
              items:
                - key: ca-bundle.crt
                  path: ca-bundle.crt
              optional: true
          - name: docker-config
            projected:
              sources:
                - secret:
                    name: regcred
                    items:
                      - key: .dockerconfigjson
                        path: config.json
        stepTemplate:
          volumeMounts:
            - mountPath: /var/workdir
              name: workdir
            - mountPath: /mnt/trusted-ca
              name: trusted-ca
              readOnly: true
            - mountPath: /var/docker-config
              name: docker-config
              readOnly: true
          env:
            - name: HOME
              value: /tekton/home
            - name: DOCKER_CONFIG
              value: /var/docker-config

        steps:
          - name: write-snapshot
            image: registry.access.redhat.com/ubi9/ubi-minimal:latest
            env:
              - name: IMAGE
                value: "$(params.image)"
            script: |
              #!/bin/bash
              set -euo pipefail
              mkdir -p /var/workdir
              printf '%s' \
                "{\"components\":[{\"name\":\"testrepo\",\"containerImage\":\"$IMAGE\"}]}" \
                > /var/workdir/snapshot.json
              echo "snapshot.json:"
              cat /var/workdir/snapshot.json
              mkdir -p /tekton/home/.docker
              chmod 777 /tekton/home/.docker
              if [ -f /tekton/home/.docker/config.json ]; then
                chmod 666 /tekton/home/.docker/config.json
              fi

          - name: initialize-tuf
            image: quay.io/conforma/cli:latest
            script: |
              echo 'TUF_MIRROR not configured — skipping TUF root initialization.'

          - name: validate
            image: quay.io/conforma/cli:latest
            onError: continue
            env:
              - name: POLICY_CONFIGURATION
                value: "$(params.POLICY_CONFIGURATION)"
              - name: PUBLIC_KEY
                value: "$(params.PUBLIC_KEY)"
              - name: IGNORE_REKOR
                value: "$(params.IGNORE_REKOR)"
              - name: WORKERS
                value: "$(params.WORKERS)"
            script: |
              #!/bin/bash
              set -euo pipefail
              if [ -f "/mnt/trusted-ca/ca-bundle.crt" ]; then
                export SSL_CERT_FILE="/mnt/trusted-ca/ca-bundle.crt"
              fi
              ec validate image \
                --images=/var/workdir/snapshot.json \
                --policy="${POLICY_CONFIGURATION}" \
                --public-key="${PUBLIC_KEY}" \
                --ignore-rekor="${IGNORE_REKOR}" \
                --workers="${WORKERS}" \
                --strict=false \
                --info=true \
                --timeout=0 \
                --output="text=/var/workdir/text-report.txt?show-successes=false" \
                --output="json=/var/workdir/report-json.json" \
                --output="appstudio=$(results.TEST_OUTPUT.path)"

          - name: detailed-report
            image: quay.io/conforma/cli:latest
            onError: continue
            command: ["cat"]
            args: ["/var/workdir/text-report.txt"]

          - name: summary
            image: quay.io/conforma/cli:latest
            onError: continue
            command: ["jq"]
            args: [".", "$(results.TEST_OUTPUT.path)"]

          - name: version
            image: quay.io/conforma/cli:latest
            command: ["ec"]
            args: ["version"]

          - name: assert
            image: quay.io/conforma/cli:latest
            env:
              - name: STRICT
                value: "$(params.STRICT)"
            command: ["jq"]
            args:
              - "--argjson"
              - "strict"
              - "$(params.STRICT)"
              - "-e"
              - '.result == "SUCCESS" or .result == "WARNING" or ($strict | not)'
              - "$(results.TEST_OUTPUT.path)"
      params:
        - name: image
          value: "$(tasks.extract-images.results.image)"
        - name: POLICY_CONFIGURATION
          value: "enterprise-contract-service/default"
        - name: PUBLIC_KEY
          value: "k8s://openshift-pipelines/public-key"
        - name: IGNORE_REKOR
          value: "true"
        - name: STRICT
          value: "false"

    # ── Task 3: Push the released image to the staging registry ───────────────
    # skopeo copy handles OCI manifest lists transparently — when the source image
    # is a multi-arch index, the entire index (all per-arch manifests) is copied.
    - name: push-to-staging-registry
      runAfter:
        - validate-enterprise-contract
      taskSpec:
        params:
          - name: source-image
            type: string
          - name: target-registry
            type: string
            # Replace YOUR-ORG with your staging quay.io org/username
            default: "quay.io/YOUR-ORG"
        steps:
          - name: copy-image
            image: quay.io/skopeo/stable:latest
            env:
              - name: SOURCE
                value: "$(params.source-image)"
              - name: TARGET
                value: "$(params.target-registry)/testrepo:latest"
              - name: DOCKER_CONFIG_JSON
                valueFrom:
                  secretKeyRef:
                    name: regcred
                    key: .dockerconfigjson
            script: |
              #!/bin/bash
              set -e
              mkdir -p /tmp/auth
              printf '%s' "$DOCKER_CONFIG_JSON" > /tmp/auth/config.json
              echo "Copying: $SOURCE → $TARGET"
              skopeo copy \
                --authfile /tmp/auth/config.json \
                --all \
                "docker://$SOURCE" \
                "docker://$TARGET"
              echo "Multi-arch index pushed to staging registry."
              rm -f /tmp/auth/config.json
      params:
        - name: source-image
          value: "$(tasks.extract-images.results.image)"

    # ── Task 4: Tag the released image as stable ──────────────────────────────
    - name: post-release-actions
      runAfter:
        - push-to-staging-registry
      taskSpec:
        params:
          - name: image
            type: string
          - name: release-name
            type: string
          - name: target-registry
            type: string
            # Replace YOUR-ORG with your staging quay.io org/username
            default: "quay.io/YOUR-ORG"
        steps:
          - name: tag-stable
            image: quay.io/skopeo/stable:latest
            env:
              - name: IMAGE
                value: "$(params.image)"
              - name: RELEASE
                value: "$(params.release-name)"
              - name: TARGET_REGISTRY
                value: "$(params.target-registry)"
              - name: DOCKER_CONFIG_JSON
                valueFrom:
                  secretKeyRef:
                    name: regcred
                    key: .dockerconfigjson
            script: |
              #!/bin/bash
              set -e
              mkdir -p /tmp/auth
              printf '%s' "$DOCKER_CONFIG_JSON" > /tmp/auth/config.json
              echo "=================================================="
              echo "           RELEASE SUMMARY"
              echo "=================================================="
              echo "Release name   : $RELEASE"
              echo "Released image : $IMAGE"
              echo "=================================================="
              STABLE_TAG="$TARGET_REGISTRY/testrepo:stable"
              echo ""
              echo "Tagging as stable: $STABLE_TAG"
              skopeo copy \
                --authfile /tmp/auth/config.json \
                --all \
                "docker://$IMAGE" \
                "docker://$STABLE_TAG"
              echo "Stable tag updated."
              rm -f /tmp/auth/config.json
      params:
        - name: image
          value: "$(tasks.extract-images.results.image)"
        - name: release-name
          value: "$(params.release)"
        - name: target-registry
          value: "quay.io/YOUR-ORG"

#!/bin/bash
# Verify that the built testrepo image is a proper multi-arch OCI Image Index.
# Run this after the multiarch-push pipeline completes.
#
# Usage:
#   IMAGE_URL=quay.io/YOUR-ORG/testrepo
#   DIGEST=$(oc get pipelinerun -n default-tenant \
#     --sort-by=.metadata.creationTimestamp \
#     -o jsonpath='{.items[-1].status.results[?(@.name=="IMAGE_DIGEST")].value}')
#   bash verify-manifest.sh "$IMAGE_URL" "$DIGEST"

IMAGE="${1:-quay.io/YOUR-ORG/testrepo}"
DIGEST="${2:-sha256:REPLACE_WITH_ACTUAL_DIGEST}"

echo "=== Multi-Arch Manifest Verification ==="
echo "Image : $IMAGE"
echo "Digest: $DIGEST"
echo ""

# 1. Raw manifest — mediaType must be application/vnd.oci.image.index.v1+json
echo "--- 1. Raw OCI Image Index manifest ---"
skopeo inspect --raw "docker://${IMAGE}@${DIGEST}" | python3 -m json.tool

echo ""
echo "--- 2. Architectures in the manifest list ---"
skopeo inspect --raw "docker://${IMAGE}@${DIGEST}" | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
media = data.get('mediaType', data.get('schemaVersion', '?'))
print(f'mediaType: {media}')
print('platforms:')
for m in data.get('manifests', []):
    p = m.get('platform', {})
    print(f'  {p.get(\"os\",\"?\")}/{p.get(\"architecture\",\"?\")}: {m[\"digest\"][:32]}...')
"

echo ""
echo "--- 3. Full skopeo inspect (resolves to current host arch) ---"
skopeo inspect "docker://${IMAGE}@${DIGEST}" | python3 -m json.tool