Red Hat Konflux kflux-prd-rh03 update task-sast-snyk-check-sdist - #308
Open
red-hat-konflux-kflux-prd-rh03[bot] wants to merge 1 commit into
Open
Red Hat Konflux kflux-prd-rh03 update task-sast-snyk-check-sdist#308red-hat-konflux-kflux-prd-rh03[bot] wants to merge 1 commit into
red-hat-konflux-kflux-prd-rh03[bot] wants to merge 1 commit into
Conversation
Signed-off-by: red-hat-konflux-kflux-prd-rh03 <konflux@no-reply.konflux-ci.dev>
Reviewer's GuideAdds two Konflux Pipelines-as-Code Tekton PipelineRun definitions for the Sequence diagram for task-sast-snyk-check-sdist Tekton PipelineRun (PR and push)sequenceDiagram
actor Developer
participant PipelinesAsCode
participant PipelineRun_task_sast_snyk_check_sdist
participant Task_init
participant Task_clone_repository
participant Task_prefetch_dependencies
participant Task_build_container
participant Task_build_image_index
participant Task_sast_shell_check
participant Task_sast_unicode_check
participant Task_apply_tags
Developer->>PipelinesAsCode: /ok-to-test or git push
alt [event == pull_request && target_branch == main]
PipelinesAsCode->>PipelineRun_task_sast_snyk_check_sdist: start task-sast-snyk-check-sdist-pull-request
else [event == push && target_branch == main]
PipelinesAsCode->>PipelineRun_task_sast_snyk_check_sdist: start task-sast-snyk-check-sdist-push
end
PipelineRun_task_sast_snyk_check_sdist->>Task_init: task-init
Task_init-->>PipelineRun_task_sast_snyk_check_sdist: enable-cache-proxy
PipelineRun_task_sast_snyk_check_sdist->>Task_clone_repository: git-clone-oci-ta
Task_clone_repository-->>PipelineRun_task_sast_snyk_check_sdist: SOURCE_ARTIFACT, commit, url
PipelineRun_task_sast_snyk_check_sdist->>Task_prefetch_dependencies: prefetch-dependencies-oci-ta
Task_prefetch_dependencies-->>PipelineRun_task_sast_snyk_check_sdist: SOURCE_ARTIFACT, CACHI2_ARTIFACT
PipelineRun_task_sast_snyk_check_sdist->>Task_build_container: tkn-bundle-oci-ta
Task_build_container-->>PipelineRun_task_sast_snyk_check_sdist: IMAGE_URL, IMAGE_DIGEST
PipelineRun_task_sast_snyk_check_sdist->>Task_build_image_index: build-image-index
Task_build_image_index-->>PipelineRun_task_sast_snyk_check_sdist: IMAGE_URL, IMAGE_DIGEST
alt [skip-checks == "false"]
PipelineRun_task_sast_snyk_check_sdist->>Task_sast_shell_check: sast-shell-check-oci-ta
PipelineRun_task_sast_snyk_check_sdist->>Task_sast_unicode_check: sast-unicode-check-oci-ta
end
PipelineRun_task_sast_snyk_check_sdist->>Task_apply_tags: apply-tags
Task_apply_tags-->>PipelineRun_task_sast_snyk_check_sdist: tagged IMAGE_URL, IMAGE_DIGEST
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- The pull-request and push PipelineRun YAMLs are nearly identical apart from trigger/metadata and a few param values; consider extracting the common
pipelineSpecinto a shared Pipeline (or a reusable template) and having each PipelineRun reference it to reduce duplication and future drift.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The pull-request and push PipelineRun YAMLs are nearly identical apart from trigger/metadata and a few param values; consider extracting the common `pipelineSpec` into a shared Pipeline (or a reusable template) and having each PipelineRun reference it to reduce duplication and future drift.
## Individual Comments
### Comment 1
<location path=".tekton/task-sast-snyk-check-sdist-pull-request.yaml" line_range="53-62" />
<code_context>
+ 1h, 2d, 3w for hours, days, and weeks, respectively.
+ name: image-expires-after
+ type: string
+ - default: "false"
+ description: Build a source image.
+ name: build-source-image
+ type: string
+ - default: "false"
+ description: Add built image into an OCI image index
+ name: build-image-index
+ type: string
+ - default: "false"
+ description: Enable cache proxy configuration
+ name: enable-cache-proxy
+ - default: "true"
+ description: Use the package registry proxy when prefetching dependencies
</code_context>
<issue_to_address>
**issue (bug_risk):** Explicitly set a `type` for the `enable-cache-proxy` param.
In Tekton v1, params without explicit `type` can cause validation or runtime quirks. Please add `type: string` for `enable-cache-proxy` here (and in the corresponding push PipelineRun) to keep param types consistent and avoid subtle pipeline-spec issues.
</issue_to_address>
### Comment 2
<location path=".tekton/task-sast-snyk-check-sdist-push.yaml" line_range="50-59" />
<code_context>
+ 1h, 2d, 3w for hours, days, and weeks, respectively.
+ name: image-expires-after
+ type: string
+ - default: "false"
+ description: Build a source image.
+ name: build-source-image
+ type: string
+ - default: "false"
+ description: Add built image into an OCI image index
+ name: build-image-index
+ type: string
+ - default: "false"
+ description: Enable cache proxy configuration
+ name: enable-cache-proxy
+ - default: "true"
+ description: Use the package registry proxy when prefetching dependencies
</code_context>
<issue_to_address>
**issue:** Add a `type` to `enable-cache-proxy` here as well to match the PR pipeline.
To keep this in sync with the PR PipelineRun and avoid any Tekton validation differences, please add an explicit `type: string` for `enable-cache-proxy`.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+53
to
+62
| - default: "false" | ||
| description: Skip checks against built image | ||
| name: skip-checks | ||
| type: string | ||
| - default: "false" | ||
| description: Execute the build with network isolation | ||
| name: hermetic | ||
| type: string | ||
| - default: "" | ||
| description: Build dependencies to be prefetched |
There was a problem hiding this comment.
issue (bug_risk): Explicitly set a type for the enable-cache-proxy param.
In Tekton v1, params without explicit type can cause validation or runtime quirks. Please add type: string for enable-cache-proxy here (and in the corresponding push PipelineRun) to keep param types consistent and avoid subtle pipeline-spec issues.
Comment on lines
+50
to
+59
| - default: "false" | ||
| description: Skip checks against built image | ||
| name: skip-checks | ||
| type: string | ||
| - default: "false" | ||
| description: Execute the build with network isolation | ||
| name: hermetic | ||
| type: string | ||
| - default: "" | ||
| description: Build dependencies to be prefetched |
There was a problem hiding this comment.
issue: Add a type to enable-cache-proxy here as well to match the PR pipeline.
To keep this in sync with the PR PipelineRun and avoid any Tekton validation differences, please add an explicit type: string for enable-cache-proxy.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pipelines as Code configuration proposal
To start the PipelineRun, add a new comment with content
/ok-to-testFor more detailed information about running a PipelineRun, please refer to Pipelines as Code documentation Running the PipelineRun
To customize the proposed PipelineRuns after merge, please refer to Build Pipeline customization
Please follow the block sequence indentation style introduced by the proprosed PipelineRuns YAMLs, or keep using consistent indentation level through your customized PipelineRuns. When different levels are mixed, it will be changed to the proposed style.
Summary by Sourcery
Add Tekton PipelineRun definitions to build and scan the task-sast-snyk-check-sdist image on pull requests and pushes to main.
Build: