diff --git a/pipelines/template-build/template-build.yaml b/pipelines/template-build/template-build.yaml index 24f2008972..52df944fa4 100644 --- a/pipelines/template-build/template-build.yaml +++ b/pipelines/template-build/template-build.yaml @@ -162,6 +162,19 @@ spec: value: $(tasks.build-container.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-container.results.IMAGE_URL) + - name: ecosystem-cert-preflight-checks + when: + - input: $(params.skip-checks) + operator: in + values: ["false"] + runAfter: + - build-container + taskRef: + name: ecosystem-cert-preflight-checks + version: "0.1" + params: + - name: image-url + value: $(tasks.build-container.results.IMAGE_URL) - name: sast-snyk-check when: - input: $(params.skip-checks) diff --git a/task/ecosystem-cert-preflight-checks/0.1/README.md b/task/ecosystem-cert-preflight-checks/0.1/README.md new file mode 100644 index 0000000000..7903bb79f8 --- /dev/null +++ b/task/ecosystem-cert-preflight-checks/0.1/README.md @@ -0,0 +1,23 @@ +# ecosystem-cert-preflight-checks task + +## Description: + +The ecosystem-cert-preflight-checks task checks an image for certification readiness. + +## Params: + +| name | description | +|--------------|----------------------------------------------------------------| +| image-url | Image URL. | + +## Results: + +| name | description | +|-------------------|--------------------------------------------------| +| TEST_OUTPUT | Indicates whether the container passsed preflight| + +## Source repository for preflight: +https://github.com/redhat-openshift-ecosystem/openshift-preflight + +## Additional links: +https://connect.redhat.com/en/blog/topic/preflight diff --git a/task/ecosystem-cert-preflight-checks/0.1/ecosystem-cert-preflight-checks.yaml b/task/ecosystem-cert-preflight-checks/0.1/ecosystem-cert-preflight-checks.yaml new file mode 100644 index 0000000000..11e7e77681 --- /dev/null +++ b/task/ecosystem-cert-preflight-checks/0.1/ecosystem-cert-preflight-checks.yaml @@ -0,0 +1,59 @@ +apiVersion: tekton.dev/v1beta1 +kind: Task +metadata: + name: ecosystem-cert-preflight-checks +spec: + description: >- + Scans container images for certification readiness + params: + - name: image-url + description: Image url to scan. + results: + - name: TEST_OUTPUT + description: Preflight pass or fail outcome. + steps: + - name: check-container + image: quay.io/opdev/preflight:stable@sha256:d990cbe8fb0db4dff0f7609403992f273f07d55f89dc7d2f046eb8f9c3e48110 + args: ["check", "container", "$(params.image-url)"] + volumeMounts: + - name: pfltoutputdir + mountPath: /artifacts + - name: gather-pflt-results + image: quay.io/redhat-appstudio/appstudio-utils@sha256:586149e3f18d966f681d956ab074b4e1d8433663d615ed86e19a3804ba952dfe + volumeMounts: + - name: pfltoutputdir + mountPath: /artifacts + script: | + # Expected results directory + RESULT_JSON_PATH=artifacts/results.json + + # Process results + PFLT_RESULT="FAILURE" + PFLT_PASSED=$(cat $RESULT_JSON_PATH |jq .passed) + if [ $PFLT_PASSED = true ]; then PFLT_RESULT="SUCCESS" ; fi + PFLT_NOTE="Task prelifght is a ${PFLT_RESULT}: Refer to Tekton task logs for more information" + PFLT_PASS_COUNT=$(cat $RESULT_JSON_PATH | jq '.results.passed | length') + PFLT_FAIL_COUNT=$(cat $RESULT_JSON_PATH | jq '.results.failed |length') + PFLT_ERROR_COUNT=$(cat $RESULT_JSON_PATH | jq '.results.errors |length') + if [[ $PFLT_ERROR_COUNT > 0 ]]; then PFLT_RESULT="ERROR" ; fi + + # Generate TEST_OUTPUT + TEST_OUTPUT=$(jq -rce \ + --arg date "$(date +%s)" \ + --arg note "${PFLT_NOTE}" \ + --arg result "${PFLT_RESULT}" \ + --arg successes "${PFLT_PASS_COUNT}" \ + --arg failures "${PFLT_FAIL_COUNT}" \ + --arg warnings "0" \ + --null-input \ + '{ result: $result, + timestamp: $date, + note: $note, + successes: $successes|tonumber, + failures: $failures|tonumber, + warnings: $warnings|tonumber + }') + echo $TEST_OUTPUT | tee $(results.TEST_OUTPUT.path) + volumes: + - name: pfltoutputdir + emptyDir: {} diff --git a/task/ecosystem-cert-preflight-checks/OWNERS b/task/ecosystem-cert-preflight-checks/OWNERS new file mode 100644 index 0000000000..a95dc6ba06 --- /dev/null +++ b/task/ecosystem-cert-preflight-checks/OWNERS @@ -0,0 +1,2 @@ + +opdev