Skip to content

feat(tkn-bundle-oci-ta): add STEPS_IMAGE_STEP_NAMES #3135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
joejstuart wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

feat(tkn-bundle-oci-ta): add STEPS_IMAGE_STEP_NAMES #3135

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .tekton/cli-main-pull-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -301,6 +301,8 @@ spec:
value: tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml
- name: STEPS_IMAGE
value: $(params.bundle-cli-ref-repo)@$(tasks.build-image-index.results.IMAGE_DIGEST)
- name: STEPS_IMAGE_STEP_NAMES
value: !use-trusted-artifact
Comment on lines +304 to +305
Copy link
Contributor

@qodo-code-review qodo-code-review bot Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Bad step-name filter 🐞 Bug ✓ Correctness

STEPS_IMAGE_STEP_NAMES is set to !use-trusted-artifact, which does not correspond to the steps
that use quay.io/conforma/cli:latest, so the intended STEPS_IMAGE replacement likely won’t be
applied to the conforma CLI steps. Additionally, the leading ! is YAML tag syntax unless quoted,
so this may not be treated as the intended literal string value.
Agent Prompt 
### Issue description
`STEPS_IMAGE_STEP_NAMES` is currently set to `!use-trusted-artifact`, which (a) is not one of the step names that actually use `quay.io/conforma/cli:latest` in `verify-conforma-konflux-ta`, and (b) uses a leading `!` that YAML can interpret as tag syntax unless quoted.

### Issue Context
In `tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml`, the steps using `quay.io/conforma/cli:latest` are `initialize-tuf`, `reduce`, and `validate`, while `use-trusted-artifact` uses a different image.

### Fix Focus Areas
- .tekton/cli-main-pull-request.yaml[304-305]
- .tekton/cli-main-push.yaml[306-307]
- tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml[243-286]

### Implementation notes
- Update `STEPS_IMAGE_STEP_NAMES` to the correct step name(s) (likely a list/string of `initialize-tuf`, `reduce`, `validate`) in the format required by `task-tkn-bundle-oci-ta`.
- Ensure the YAML value is a normal string scalar (quote if needed).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

- name: URL
value: $(params.git-url)
- name: REVISION
Expand All @@ -314,7 +316,8 @@ spec:
- name: name
value: tkn-bundle-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-tkn-bundle-oci-ta:0.2@sha256:ceb35ce497159209c8a329dcf3969b337a8ea527412d098f0071ec48d76a5693
# need to add digest
value: quay.io/konflux-ci/tekton-catalog/task-tkn-bundle-oci-ta:0.3
Comment on lines +319 to +320
Copy link
Contributor

@qodo-code-review qodo-code-review bot Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

2. Unpinned task bundle 🐞 Bug ⛨ Security

The tkn-bundle-oci-ta bundle reference was changed to a mutable tag (:0.3) without a digest,
making CI non-reproducible and potentially pulling different task contents over time. This also
breaks the existing pattern in these PipelineRuns where bundle-resolved tasks are digest-pinned.
Agent Prompt 
### Issue description
`tkn-bundle-oci-ta` is referenced as `...:0.3` without an `@sha256:` digest, making the resolved task mutable and CI runs non-reproducible.

### Issue Context
These PipelineRuns already pin other bundle-resolved tasks by digest; `tkn-bundle-oci-ta` should follow the same pattern.

### Fix Focus Areas
- .tekton/cli-main-pull-request.yaml[318-320]
- .tekton/cli-main-push.yaml[320-322]

### Implementation notes
- Resolve the digest for `quay.io/konflux-ci/tekton-catalog/task-tkn-bundle-oci-ta:0.3` and update the `bundle:` value to include `@sha256:<digest>`.
- Remove the temporary comment once the digest is added.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

- name: kind
value: task
resolver: bundles
Expand Down
5 changes: 4 additions & 1 deletion .tekton/cli-main-push.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -303,6 +303,8 @@ spec:
value: tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml
- name: STEPS_IMAGE
value: $(params.bundle-cli-ref-repo)@$(tasks.build-image-index.results.IMAGE_DIGEST)
- name: STEPS_IMAGE_STEP_NAMES
value: !use-trusted-artifact
- name: URL
value: $(params.git-url)
- name: REVISION
Expand All @@ -316,7 +318,8 @@ spec:
- name: name
value: tkn-bundle-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-tkn-bundle-oci-ta:0.2@sha256:ceb35ce497159209c8a329dcf3969b337a8ea527412d098f0071ec48d76a5693
# need to add digest
value: quay.io/konflux-ci/tekton-catalog/task-tkn-bundle-oci-ta:0.3
- name: kind
value: task
resolver: bundles
Expand Down
Loading