From 667f78b67e62cf30ef9606dd4d3434f51e63fae5 Mon Sep 17 00:00:00 2001 From: Zoran Regvart Date: Mon, 15 Jul 2024 12:01:28 +0200 Subject: [PATCH] Configure hermetic build --- .tekton/cli-main-ci-push.yaml | 4 +- hack/update-rpm-lock.sh | 94 ++++++++++++++++++++++++ rpms.in.yaml | 27 +++++++ rpms.lock.yaml | 130 ++++++++++++++++++++++++++++++++++ 4 files changed, 254 insertions(+), 1 deletion(-) create mode 100755 hack/update-rpm-lock.sh create mode 100644 rpms.in.yaml create mode 100644 rpms.lock.yaml diff --git a/.tekton/cli-main-ci-push.yaml b/.tekton/cli-main-ci-push.yaml index 507114707..200b0b308 100644 --- a/.tekton/cli-main-ci-push.yaml +++ b/.tekton/cli-main-ci-push.yaml @@ -30,7 +30,7 @@ spec: - name: revision value: '{{revision}}' - name: prefetch-input - value: gomod + value: '[{"type": "gomod"}, {"type": "rpm"}]' - name: build-source-image value: 'true' - name: build-args-file @@ -184,6 +184,8 @@ spec: value: $(params.output-image).prefetch - name: ociArtifactExpiresAfter value: $(params.image-expires-after) + - name: dev-package-managers + value: 'true' runAfter: - clone-repository taskRef: diff --git a/hack/update-rpm-lock.sh b/hack/update-rpm-lock.sh new file mode 100755 index 000000000..f894ba78c --- /dev/null +++ b/hack/update-rpm-lock.sh @@ -0,0 +1,94 @@ +#!/usr/bin/env bash +# Copyright The Enterprise Contract Contributors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 + +# Updates the rpms.lock.yaml file + +set -o errexit +set -o pipefail +set -o nounset + +root_dir=$(git rev-parse --show-toplevel) + +latest_release=$(gh api '/repos/konflux-ci/rpm-lockfile-prototype/tags?per_page=1' --jq '.[0].name') + +# build the image for running the RPM lock tool +echo Building... +image=$(podman build --quiet --file <(cat <