tasks/acs*: don't fail when ACS is not configured

[chmeliik]

• The report step in all tasks now cats the file only if it exists
• The image-scan task writes an empty SCAN_OUTPUT when skipped
  • Otherwise the pipeline fails because the ACS_SCAN_OUTPUT result references a non-existent task result

Before you complete this pull request ...

Look for any open pull requests in the repository with the title "e2e-tests update" and
see if there are recent e2e-tests updates that will be applicable to your change.

[chmeliik]

Seems to work more or less as intended

STEP-ANNOTATE-TASK
acs-image-scan idk2-on-push-btn86-acs-image-scan
taskrun.tekton.dev/idk2-on-push-btn86-acs-image-scan annotated
taskrun.tekton.dev/idk2-on-push-btn86-acs-image-scan annotated
taskrun.tekton.dev/idk2-on-push-btn86-acs-image-scan annotated
taskrun.tekton.dev/idk2-on-push-btn86-acs-image-scan annotated
taskrun.tekton.dev/idk2-on-push-btn86-acs-image-scan annotated

STEP-ROX-IMAGE-SCAN
rox API endpoint is not set, demo will exit with success
TODO: configure the pipeline with your ACS server domain. Set your ACS endpoint under 'rox-api-endpoint' key in the secret specified in rox-secret-name parameter. For example: 'rox.stackrox.io:443'
{"result":"SKIPPED","timestamp":"1710419206","note":"Task idk2-on-push-btn86-acs-image-scan skipped: ACS API enpoint not specified","namespace":"default","successes":"0","failures":"0","warnings":"0"}

STEP-REPORT

[jduimovich]

I assume the empty ACS_SCAN_OUTPUT causes the 0 values in the vulnerabilties ?

[chmeliik]

I assume the empty ACS_SCAN_OUTPUT causes the 0 values in the vulnerabilties ?

Probably yes. I don't see an easy way to avoid that

[chmeliik]

/retest

[chmeliik]

Just for completeness: if we didn't write the empty result here, the pipeline would fail with

invalid pipelineresults [ACS_SCAN_OUTPUT], the referred results don't exist

And this failure is only visible directly in the OCP console. RHDH just shows all the tasks as green and the overall result as red

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[chmeliik]

From a discussion with John: the 0s in the vulnerabilities report are a problem, we'd like a better solution

maybe the solution is to have a pre-check task the extracts the secrets, validates access and if successful, the ACS tasks can run

The other solution which could work is not annotate if not successful. Of course when they fix pac, the annotations won't be lost

The other behaviour could to use the onError: continue so you can error but the pipeline succeeds overall and when you read the error message the "You have not configured your rox secret etc" can be printed