Red Hat Konflux kflux-prd-rh03 update task-promote-npm-oci

[red-hat-konflux-kflux-prd-rh03]

Pipelines as Code configuration proposal

To start the PipelineRun, add a new comment with content /ok-to-test

For more detailed information about running a PipelineRun, please refer to Pipelines as Code documentation Running the PipelineRun

To customize the proposed PipelineRuns after merge, please refer to Build Pipeline customization

Please follow the block sequence indentation style introduced by the proprosed PipelineRuns YAMLs, or keep using consistent indentation level through your customized PipelineRuns. When different levels are mixed, it will be changed to the proposed style.

Summary by Sourcery

Add Tekton Pipelines-as-Code PipelineRuns for building and scanning the task-promote-npm-oci image on pull requests and pushes to main.

New Features:

• Introduce a pull-request PipelineRun to build a temporary task-promote-npm-oci container image and run security and quality checks.
• Introduce a push PipelineRun to build and publish the task-promote-npm-oci container image on main branch updates with associated checks.

[sourcery-ai]

Reviewer's Guide

Adds Konflux Pipelines-as-Code PipelineRun definitions for the task-promote-npm-oci component, defining build-and-scan pipelines for both pull_request and push events using the standard docker-build-oci-ta pipeline with trusted artifacts and security checks.

Flow diagram for task-promote-npm-oci docker-build-oci-ta pipeline

flowchart TD
  Init[init]
  Clone[clone-repository]
  Prefetch[prefetch-dependencies]
  Build[build-container]
  Index[build-image-index]
  Checks[(security and compliance checks)]
  Apply[apply-tags]
  PushDF[push-dockerfile]

  Init --> Clone --> Prefetch --> Build --> Index
  Index --> Checks
  Index --> Apply --> PushDF

Loading

File-Level Changes

Change	Details	Files
Introduce Pipelines-as-Code PipelineRun for building and validating task-promote-npm-oci on pull requests.	Create a PipelineRun triggered by pull_request events on main using a CEL on-cel-expression filter Configure parameters for git URL, revision, output image (temporary PR tag), image expiry, and Containerfile path Embed an inline pipelineSpec based on the Konflux docker-build-oci-ta pipeline with trusted-artifact-based tasks Wire tasks for init, git clone into OCI storage, dependency prefetch, image build via buildah, image index creation, optional source image build, and multiple security/compliance scans (deprecated base image, clair, ecosystem preflight, SAST checks, clamav, RPM signature) Set workspace bindings, service account (build-pipeline-task-promote-npm-oci), and optional git-auth secret for authenticated cloning	.tekton/task-promote-npm-oci-pull-request.yaml
Introduce Pipelines-as-Code PipelineRun for building and validating task-promote-npm-oci on pushes to main.	Create a PipelineRun triggered by push events on main with appropriate CEL on-cel-expression filter and non-cancelling behavior Configure parameters for git URL, revision, and output image tagged with the commit SHA, plus Containerfile path Embed an inline pipelineSpec mirroring the PR pipeline, sharing the same trusted-artifact task graph, params, results, and security/compliance checks Set workspace bindings, service account (build-pipeline-task-promote-npm-oci), and optional git-auth secret consistent with the pull-request PipelineRun	.tekton/task-promote-npm-oci-push.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• The pull-request and push PipelineRun definitions duplicate an almost identical pipelineSpec; consider extracting the shared spec into a reusable template or base file to reduce drift and simplify future updates.
• In the push PipelineRun, image-expires-after is only set via the inner pipelineSpec default and not at the top-level spec.params like in the PR PipelineRun; double-check whether you intentionally want different image expiration behavior between PR and push builds.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The pull-request and push PipelineRun definitions duplicate an almost identical `pipelineSpec`; consider extracting the shared spec into a reusable template or base file to reduce drift and simplify future updates.
- In the push PipelineRun, `image-expires-after` is only set via the inner `pipelineSpec` default and not at the top-level `spec.params` like in the PR PipelineRun; double-check whether you intentionally want different image expiration behavior between PR and push builds.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}