Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add docker-build-oci-ta Pipeline #1024

Merged
merged 2 commits into from
May 28, 2024
Merged

Add docker-build-oci-ta Pipeline #1024

merged 2 commits into from
May 28, 2024

Conversation

lcarva
Copy link
Contributor

@lcarva lcarva commented May 16, 2024

This Pipeline, based on the docker-build Pipeline, uses Trusted Artifacts stored in an OCI registry to share data between Tasks. No PVC is needed.

Ref: EC-555

Before you complete this pull request ...

Look for any open pull requests in the repository with the title "e2e-tests update" and
see if there are recent e2e-tests updates that will be applicable to your change.

@lcarva
Copy link
Contributor Author

lcarva commented May 16, 2024

I'll likely have to adjust this once #1022 is merged.

@lcarva
Copy link
Contributor Author

lcarva commented May 16, 2024

Moving this to draft because there are two gaps here:

  1. We need to also introduce a version of the show-sbom Task that understand trusted artifacts 😢
  2. The patch.yaml here needs to actually remove the workspace from the docker-build-oci-ta Pipeline definition

@lcarva lcarva marked this pull request as draft May 16, 2024 20:10
@lcarva lcarva marked this pull request as ready for review May 16, 2024 21:08
@lcarva
Copy link
Contributor Author

lcarva commented May 16, 2024

Ready for review. We decided that the summary Task doesn't provide a whole lot of value. We will exclude it from the docker-build-oci-ta Pipeline. See the comments here for additional context.

(Also, if you do think we should include the summary Task in this new Pipeline, let me know!)

@lcarva lcarva force-pushed the EC-555 branch 3 times, most recently from 8423d32 to eb8f827 Compare May 17, 2024 14:34
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

@lcarva
Copy link
Contributor Author

lcarva commented May 20, 2024

@mmorhun, could you please create the pipeline-docker-build-oci-ta repository in https://quay.io/organization/redhat-appstudio-tekton-catalog?

name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
- op: remove
path: /spec/tasks/4/workspaces/0
Copy link
Contributor

@simonbaird simonbaird May 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you consider removing the whole thing when you expect it to be empty afterwards?

Suggested change
path: /spec/tasks/4/workspaces/0
path: /spec/tasks/4/workspaces

Just an idea for tidier yaml - I don't think it would make any functional difference.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

..and of course you can't do that for the tasks with the git-auth workspace..

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm gonna leave it as is for consistency. The empty array is not a big deal.

@simonbaird
Copy link
Contributor

I did this to compare the old/new:

vimdiff <(kustomize build pipelines/docker-build) <(kustomize build pipelines/docker-build-oci-ta)

Looks nice and tidy except I guess for the show-summary removal.

@zregvart
Copy link
Member

/retest

This Pipeline, based on the docker-build Pipeline, uses Trusted
Artifacts stored in an OCI registry to share data between Tasks. No PVC
is needed.

Ref: EC-555

Signed-off-by: Luiz Carvalho <[email protected]>
@zregvart zregvart enabled auto-merge May 27, 2024 09:40
@lcarva
Copy link
Contributor Author

lcarva commented May 28, 2024

/retest

@lcarva
Copy link
Contributor Author

lcarva commented May 28, 2024

CI is failing here with an odd error:

Trying to pull registry.access.redhat.com/ubi8/nodejs-18-minimal:latest...
Error: creating build container: copying system image from manifest list: Source image rejected: None of the signatures were accepted, reasons: Signature for identity registry.access.redhat.com/ubi8/nodejs-18-minimal:1-115.1716502126 is not accepted; Signature for identity registry.redhat.io/ubi8/nodejs-18-minimal:1-115.1716502126 is not accepted

I can reproduce the issue locally with podman pull on Fedora 39. Pulling by the latest tag shows the same error. Pulling by the NVR tag works.

https://issues.redhat.com/browse/CLOUDDST-23015

@lcarva
Copy link
Contributor Author

lcarva commented May 28, 2024

/retest

@zregvart zregvart added this pull request to the merge queue May 28, 2024
@lcarva
Copy link
Contributor Author

lcarva commented May 28, 2024

/lgtm

@lcarva lcarva disabled auto-merge May 28, 2024 19:49
Merged via the queue into konflux-ci:main with commit 0a28d1d May 28, 2024
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants