3939
4040 _Uses `buildah` to create a container image. It also optionally creates a source image and runs some build-time tests. EC will flag a violation for [`trusted_task.trusted`](https://enterprisecontract.dev/docs/ec-policies/release_policy.html#trusted_task__trusted) if any tasks are added to the pipeline.
4141 This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build?tab=tags)_
42- finally :
43- - name : show-sbom
44- params :
45- - name : IMAGE_URL
46- value : $(tasks.build-image-index.results.IMAGE_URL)
47- taskRef :
48- params :
49- - name : name
50- value : show-sbom
51- - name : bundle
52- value : quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:e2c1b4eac642f32e91f3bc5d3cb48c5c70888aaf45c3650d9ea34573de7a7fd5
53- - name : kind
54- value : task
55- resolver : bundles
56- - name : show-summary
57- params :
58- - name : pipelinerun-name
59- value : $(context.pipelineRun.name)
60- - name : git-url
61- value : $(tasks.clone-repository.results.url)?rev=$(tasks.clone-repository.results.commit)
62- - name : image-url
63- value : $(params.output-image)
64- - name : build-task-status
65- value : $(tasks.build-image-index.status)
66- taskRef :
67- params :
68- - name : name
69- value : summary
70- - name : bundle
71- value : quay.io/konflux-ci/tekton-catalog/task-summary:0.2@sha256:3f6e8513cbd70f0416eb6c6f2766973a754778526125ff33d8e3633def917091
72- - name : kind
73- value : task
74- resolver : bundles
75- workspaces :
76- - name : workspace
77- workspace : workspace
7842 params :
7943 - description : Source Repository URL
8044 name : git-url
@@ -129,6 +93,22 @@ spec:
12993 default : docker
13094 type : string
13195 description : The format for the resulting image's mediaType. Valid values are oci or docker.
96+ - name : source-date-epoch
97+ type : string
98+ default : ' '
99+ description : Sets the image created time and the SOURCE_DATE_EPOCH build argument. On its own, it does not change file timestamps inside the layers (set rewrite-timestamp to "true" for that). Leave empty to keep the actual build time.
100+ - name : rewrite-timestamp
101+ type : string
102+ default : ' false'
103+ description : When "true", clamp file modification times in the image layers to at most source-date-epoch. Does nothing unless source-date-epoch is set.
104+ - name : omit-history
105+ type : string
106+ default : ' false'
107+ description : When "true", omit the build history (history timestamps, layer metadata, etc.) from the resulting image.
108+ - name : enable-package-registry-proxy
109+ default : ' true'
110+ description : Use the package registry proxy when prefetching dependencies
111+ type : string
132112 results :
133113 - description : " "
134114 name : IMAGE_URL
@@ -149,7 +129,7 @@ spec:
149129 - name : name
150130 value : init
151131 - name : bundle
152- value : quay.io/konflux-ci/tekton-catalog/task-init:0.3@sha256:aa6f8632cc23d605c5942505ff1d00280db16a6fda5c4c56c4ed9ae936b5fbc6
132+ value : quay.io/konflux-ci/tekton-catalog/task-init:0.4. 3@sha256:c6c414a3b5dcd827720f3443a128a02d27a0a5071ea3e4dc0063d578f1f73a74
153133 - name : kind
154134 value : task
155135 resolver : bundles
@@ -166,7 +146,7 @@ spec:
166146 - name : name
167147 value : git-clone
168148 - name : bundle
169- value : quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1 @sha256:865cdbe6094ff52d9e5dfc40d44ca5cfa6cee4b665aef91306356652fb84d7cc
149+ value : quay.io/konflux-ci/tekton-catalog/task-git-clone:0.2.6 @sha256:5512606f2a50580cc91e3e3acf6cc14b94e764754a7acdf8dd70858a8bcc8d9d
170150 - name : kind
171151 value : task
172152 resolver : bundles
@@ -179,14 +159,16 @@ spec:
179159 params :
180160 - name : input
181161 value : $(params.prefetch-input)
162+ - name : enable-package-registry-proxy
163+ value : $(params.enable-package-registry-proxy)
182164 runAfter :
183165 - clone-repository
184166 taskRef :
185167 params :
186168 - name : name
187169 value : prefetch-dependencies
188170 - name : bundle
189- value : quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies:0.2 @sha256:6f05f1b9e4c7f6035ccc555dcfb375726a81c605039b76ffde258810922528c5
171+ value : quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies:0.10.3 @sha256:7629fe3f43f669b6f5c2045f3a107047e68eb5c8338e2518c6d95a3bb0ad422c
190172 - name : kind
191173 value : task
192174 resolver : bundles
@@ -225,14 +207,20 @@ spec:
225207 value : $(params.build-args-file)
226208 - name : BUILDAH_FORMAT
227209 value : $(params.buildah-format)
210+ - name : SOURCE_DATE_EPOCH
211+ value : $(params.source-date-epoch)
212+ - name : REWRITE_TIMESTAMP
213+ value : $(params.rewrite-timestamp)
214+ - name : OMIT_HISTORY
215+ value : $(params.omit-history)
228216 runAfter :
229217 - prefetch-dependencies
230218 taskRef :
231219 params :
232220 - name : name
233221 value : buildah
234222 - name : bundle
235- value : quay.io/konflux-ci/tekton-catalog/task-buildah:0.8 @sha256:4d0ccdc2d600876efd281f28a19f36361cc34a179595b70675a020431f1105b4
223+ value : quay.io/konflux-ci/tekton-catalog/task-buildah:0.12.1 @sha256:57b6a425cf1dbd26ea3876e2b3e4eb01348b860140cacb83045ded36ecebdcc0
236224 - name : kind
237225 value : task
238226 resolver : bundles
@@ -243,10 +231,6 @@ spec:
243231 params :
244232 - name : IMAGE
245233 value : $(params.output-image)
246- - name : COMMIT_SHA
247- value : $(tasks.clone-repository.results.commit)
248- - name : IMAGE_EXPIRES_AFTER
249- value : $(params.image-expires-after)
250234 - name : ALWAYS_BUILD_INDEX
251235 value : $(params.build-image-index)
252236 - name : IMAGES
@@ -261,7 +245,7 @@ spec:
261245 - name : name
262246 value : build-image-index
263247 - name : bundle
264- value : quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.2 @sha256:30989fa1f475bb8f6bda811b26bd4ddf7187288ed5815ce634ba399341852c75
248+ value : quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1 @sha256:6ead03ca82a1b970dc60eaadae86adf374e8e70f8d951902e1fac7411dbe0550
265249 - name : kind
266250 value : task
267251 resolver : bundles
@@ -278,7 +262,7 @@ spec:
278262 - name : name
279263 value : source-build
280264 - name : bundle
281- value : quay.io/konflux-ci/tekton-catalog/task-source-build:0.3@sha256:1375b2de61d1ba1fd3bf586617d1800722477771dcebe11f6e40757d558df0d3
265+ value : quay.io/konflux-ci/tekton-catalog/task-source-build:0.3.1 @sha256:af4bd243462932fa4ca76c14294ca552e57191fb38e8c870b47c022c8ca84bb4
282266 - name : kind
283267 value : task
284268 resolver : bundles
@@ -303,7 +287,7 @@ spec:
303287 - name : name
304288 value : deprecated-image-check
305289 - name : bundle
306- value : quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e3a55ccdf1091b4a35507f9ee2d1918d8e89a5f96babcb5486b491226da03d6f
290+ value : quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872
307291 - name : kind
308292 value : task
309293 resolver : bundles
@@ -312,7 +296,7 @@ spec:
312296 operator : in
313297 values :
314298 - " false"
315- - name : clair -scan
299+ - name : roxctl -scan
316300 params :
317301 - name : image-digest
318302 value : $(tasks.build-image-index.results.IMAGE_DIGEST)
@@ -323,9 +307,9 @@ spec:
323307 taskRef :
324308 params :
325309 - name : name
326- value : clair -scan
310+ value : roxctl -scan
327311 - name : bundle
328- value : quay.io/konflux-ci/tekton-catalog/task-clair -scan:0.3 @sha256:b01d8e2c58eb407ac23fa07b8e44c4631f0cf7257e87507c829fa2486aff9804
312+ value : quay.io/konflux-ci/tekton-catalog/task-roxctl -scan:0.1 @sha256:97e2b2cdca9110fdc8a93ba585a1a1a743f989f2fd85f4073f6e5ea9ad2ce828
329313 - name : kind
330314 value : task
331315 resolver : bundles
@@ -345,7 +329,7 @@ spec:
345329 - name : name
346330 value : ecosystem-cert-preflight-checks
347331 - name : bundle
348- value : quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:40bc4bcc1c52c114139daee60ec2ddeb59921ecef8a68f241d5593c79b2a21d6
332+ value : quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:fa53ef450ba538addafee1211ff6ac15b55865ce652fec15ac99b554680cb642
349333 - name : kind
350334 value : task
351335 resolver : bundles
@@ -367,7 +351,7 @@ spec:
367351 - name : name
368352 value : sast-snyk-check
369353 - name : bundle
370- value : quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check:0.4 @sha256:d380f0f37219f334340d3660fd42ea4f9f1ec868d8dd72878d0e71ab7fa4469d
354+ value : quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check:0.5 @sha256:39d5cbb24bbf761307afcb1e63570370af8720528f41cb5b4152fe28d0139b58
371355 - name : kind
372356 value : task
373357 resolver : bundles
@@ -392,7 +376,7 @@ spec:
392376 - name : name
393377 value : clamav-scan
394378 - name : bundle
395- value : quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:5b5b31eae9063a00b91acc049b536e548d87c730068e439eefe33ab5238ee118
379+ value : quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.3 @sha256:9df272d2180bd67e6a3e04d5cd30ffa7ba27af4e599a1922f7069f5c89888e5b
396380 - name : kind
397381 value : task
398382 resolver : bundles
@@ -414,7 +398,7 @@ spec:
414398 - name : name
415399 value : apply-tags
416400 - name : bundle
417- value : quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:510b6d2a3b188adeb716e49566b57d611ab36bd69a2794b5ddfc11dbf014c2ca
401+ value : quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3.1 @sha256:b1c71d83be8e6d0e44f9b6e58e1ad491396d4c287be9291802c9be69d9441f2f
418402 - name : kind
419403 value : task
420404 resolver : bundles
@@ -435,7 +419,7 @@ spec:
435419 - name : name
436420 value : push-dockerfile
437421 - name : bundle
438- value : quay.io/konflux-ci/tekton-catalog/task-push-dockerfile:0.1@sha256:6ac48e8f499553eec5f201848aa275dead47b8f3493dc68eeb74fc8c43c7871f
422+ value : quay.io/konflux-ci/tekton-catalog/task-push-dockerfile:0.3. 1@sha256:eb8681b9c9d01b4ff3170581f322882cfd80a663500fc509e63f1a2f05e925b8
439423 - name : kind
440424 value : task
441425 resolver : bundles
0 commit comments