feat: push Dockerfile to registry

[tkdchen]

STONEBLD-2522

Add a new task push-dockerfile to push Dockerfile to registry as an OCI
artifact.

Task is configurable to accept varaints of Dockerfile with different
names, like Containerfile.

Use `oras pull' to get the image.

This new task is added to docker-build pipeline and enabled by default.

Trusted Artifacts version of push-dockerfile is created accordingly and
updated into the docker-build-oci-ta pipeline.

[chmeliik]

I'll also note that it will not be possible for the release service (or any other consumer) to verify that the content of the .dockerfile image is still the same as what the build pipeline pushed. Which is probably fine, IIUC the Dockerfile image is probably just a nice-to-have informational kind of thing

[chmeliik]

Did you consider making a separate task for pushing the Dockerfile to the registry? It doesn't really make any sense to me have it as part of the build tasks

[tkdchen]

I haven't seen any necessity to make a separate task. As an associated artifacts images like .sbom and .att, it is natural to push it as a step of the build.

[chmeliik]

I haven't seen any necessity to make a separate task. As an associated artifacts images like .sbom and .att, it is natural to push it as a step of the build.

.att and .sig are pushed by Tekton Chains, not by the build task. I would argue .sbom shouldn't be pushed by the build task either. In the current situation, we have ~9 build tasks that all have to copy-paste the same logic because they have to fulfill this undefined "interface" for what a build task should do. When some of those things don't actually make sense.

Our tasks don't really make sense as upstream parts of the Tekton ecosystem. Now we're injecting this functionality into every build task because that's more convenient for the Red Hat container catalog.

On the other hand, there is no good mechanism for sharing artifacts between tasks - other than Trusted Artifacts, which involves pushing to the registry in some form anyway.

[tkdchen]

PTAL. The previous changes are reworked by adding a new Tekton task push-build-file. Once review is done, I'll squash all the commits before merge.

[chmeliik]

Nice, this looks better to me 👍

[chmeliik]

Could you add the recipe.yaml (every oci-ta task should have one) for this task, so that auto-generation works properly?

[tkdchen]

Updated.

[chmeliik]

FYI, I think the failing ec-tasks-check should be resolved by rebasing on main

[tkdchen]

Rebased. Added recipel.yaml and add a task result IMAGE_URL.

[tkdchen]

/retest

[tkdchen]

The task push-build-file is renamed to push-dockerfile. PTAL.

[tkdchen]

Squashed all commits and rebased.