SECURESIGN-4640 Add rhtas-versions.properties file

.tekton/docker-build-multi-platform-oci-ta-pull-request.yaml

@@ -10,6 +10,7 @@ metadata:
     pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch
       == "main" && ( ".tekton/docker-build-multi-platform-oci-ta-pull-request.yaml".pathChanged()
       || "pipeline-tests".pathChanged() || "pipelines/docker-build-multi-platform-oci-ta.yaml".pathChanged()
+      || "tasks/get-version-from-configmap.yaml".pathChanged()
       )
     pipelinesascode.tekton.dev/pipeline: pipelines/docker-build-multi-platform-oci-ta.yaml
   creationTimestamp: null

.tekton/docker-build-oci-ta-pull-request.yaml

@@ -10,7 +10,7 @@ metadata:
     pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch
       == "main" && ( ".tekton/docker-build-oci-ta-pull-request.yaml".pathChanged()
       || "pipeline-tests".pathChanged() || "pipelines/docker-build-oci-ta.yaml".pathChanged()
-      || "tasks/go-unit-test-oci-ta.yaml".pathChanged() )
+      || "tasks/go-unit-test-oci-ta.yaml".pathChanged() || "tasks/get-version-from-configmap.yaml".pathChanged() )
     pipelinesascode.tekton.dev/pipeline: pipelines/docker-build-oci-ta.yaml
   creationTimestamp: null
   labels:

.tekton/docker-build-pull-request.yaml

@@ -10,6 +10,7 @@ metadata:
     pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch
       == "main" && ( ".tekton/docker-build-pull-request.yaml".pathChanged() || "pipeline-tests".pathChanged()
       || "pipelines/docker-build.yaml".pathChanged()
+      || "tasks/get-version-from-configmap.yaml".pathChanged()
       )
     pipelinesascode.tekton.dev/pipeline: pipelines/docker-build.yaml
   creationTimestamp: null

konflux-configs/README.md

@@ -264,6 +264,48 @@ konflux-configs/
 └── README.md                   # This file
 ```
 
+
+## Release Version Mappings
+
+Container image `version` labels are resolved centrally from the
+`rhtas-repo-branch-versions` ConfigMap instead of per-repo Tekton params.
+This allows bumping versions for all components and branches in a single PR
+to this repository.
+
+### Source of truth
+
+Version mappings live in
+[`base/config/rhtas-versions.properties`](base/config/rhtas-versions.properties)
+and are deployed as ConfigMap `rhtas-repo-branch-versions` via the
+configuration-as-code pipeline.
+
+**Key format:**
+
+| Pattern | Example | When used |
+|---------|---------|-----------|
+| `<repo>__<branch>` | `fulcio__release-1.4=1.4.2` | Exact repo + branch match |
+| `<repo>` | `fulcio=1.5.0-dev` | Fallback when branch-specific key is missing |
+
+The repo name is derived from the component `git-url` (e.g.
+`https://github.com/securesign/fulcio` → `fulcio`). The branch comes from
+the Pipelines-as-Code `target_branch` annotation on each PipelineRun.
+
+### Bumping versions for a release
+
+1. Edit `base/config/rhtas-versions.properties` with the new semver values
+2. Open a PR — only this repo needs to change (no per-component-repo PRs)
+3. On merge to `main`, the CAC pipeline builds and deploys the updated ConfigMap
+4. Subsequent builds on any branch pick up the new version automatically
+
+### Verifying a build
+
+Check the `get-version-from-configmap` task log for the resolved lookup key,
+then confirm the built image label:
+
+```bash
+skopeo inspect docker://quay.io/.../component@sha256:... | jq '.Labels.version'
+```
+
 ## Customization
 
 See [Directory Structure](#directory-structure) for file locations

konflux-configs/base/config/kustomization.yaml

@@ -9,3 +9,9 @@ configMapGenerator:
     literals:
       - automerge="true"
       - platformAutomerge="true"
+
+  # Release version mappings for repo+branch
+  # Versions are defined in rhtas-versions.properties
+  - name: rhtas-repo-branch-versions
+    envs:
+      - rhtas-versions.properties

konflux-configs/base/config/rhtas-versions.properties

@@ -0,0 +1,144 @@
+# RHTAS Release Version Mappings
+# Format: <repo-name>__<branch-name>=<version>
+# Double underscore (__) separates repo from branch
+
+# ============================================================================
+# RHTAS OPERATOR CORE COMPONENTS
+# These components are deployed and managed by the RHTAS operator
+# ============================================================================
+
+
+# === Fulcio ===
+fulcio__main=1.5.0
+fulcio__release-1.4=1.4.2
+fulcio__release-1.3=1.3.6
+
+# === Rekor ===
+rekor__main=1.5.0
+rekor__release-1.4=1.4.2
+rekor__release-1.3=1.3.6
+
+# === Timestamp Server ===
+timestamp-authority__main=1.5.0
+timestamp-authority__release-1.4=1.4.2
+timestamp-authority__release-1.3=1.3.6
+
+# === TUF Server ===
+tuf-server__main=1.5.0
+tuf-server__release-1.4=1.4.2
+tuf-server__release-1.3=1.3.6
+
+# === Trillian ===
+trillian__main=1.5.0
+trillian__release-1.4=1.4.2
+trillian__release-1.3=1.3.6
+
+# === RHTAS Operator (the operator itself) ===
+secure-sign-operator__main=1.5.0
+secure-sign-operator__release-1.4=1.4.2
+secure-sign-operator__release-1.3=1.3.6
+
+# === RHTAS Console ===
+rhtas-console__main=1.5.0
+rhtas-console__release-1.4=1.4.2
+rhtas-console__release-1.3=1.3.6
+
+# === RHTAS Console UI ===
+rhtas-console-ui__main=1.5.0
+rhtas-console-ui__release-1.4=1.4.2
+rhtas-console-ui__release-1.3=1.3.6
+
+# === Cosign ===
+cosign__main=1.5.0
+cosign__release-1.4=1.4.2
+cosign__release-1.3=1.3.6
+
+# === Gitsign ===
+gitsign__main=1.5.0
+gitsign__release-1.4=1.4.2
+gitsign__release-1.3=1.3.6
+
+# === Certificate Transparency Go ===
+certificate-transparency-go__main=1.5.0
+certificate-transparency-go__release-1.4=1.4.2
+certificate-transparency-go__release-1.3=1.3.6
+
+# === Model Transparency Go ===
+model-transparency-go__main=1.5.0
+model-transparency-go__release-1.4=1.4.2
+model-transparency-go__release-1.3=1.3.6
+
+# === Rekor Search UI ===
+rekor-search-ui__main=1.5.0
+rekor-search-ui__release-1.4=1.4.2
+rekor-search-ui__release-1.3=1.3.6
+# ============================================================================
+# AUXILIARY COMPONENTS
+# Supporting tools and utilities
+# ============================================================================
+
+# === Artifact Signer Ansible ===
+artifact-signer-ansible__main=1.5.0
+artifact-signer-ansible__release-1.4=1.4.2
+artifact-signer-ansible__release-1.3=1.3.6
+
+# === Model Transparency ===
+model-transparency__main=0.1.0
+
+# === Model Validation Operator ===
+model-validation-operator__main=0.1.0
+
+# === Tough ===
+tough__develop=1.5.0
+tough__release-1.4=1.4.2
+tough__release-1.3=1.3.6
+
+# === Rekor Monitor ===
+rekor-monitor__main=1.5.0-dev
+rekor-monitor__release-1.4=1.4.2
+rekor-monitor__release-1.3=1.3.6
+
+# === Segment Backup Job ===
+segment-backup-job__main=1.5.0-dev
+segment-backup-job__release-1.4=1.4.2
+segment-backup-job__release-1.3=1.3.6
+
+# ============================================================================
+# POLICY CONTROLLER COMPONENTS
+# Separate release cycle from main RHTAS components
+# ============================================================================
+
+# === Policy Controller ===
+policy-controller__main=1.5.0
+policy-controller__release-1.0=1.4.2
+
+# === Policy Controller Operator ===
+policy-controller-operator__main=1.5.0
+policy-controller-operator__release-1.0=1.4.2
+
+# ============================================================================
+# REPO-ONLY FALLBACKS
+# Used when exact repo__branch combination is not found
+# ============================================================================
+
+artifact-signer-ansible=1.5.0-dev
+certificate-transparency-go=1.5.0-dev
+cosign=1.5.0-dev
+fulcio=1.5.0-dev
+gitsign=1.5.0-dev
+model-transparency=1.5.0-dev
+model-transparency-go=1.5.0-dev
+model-validation-operator=1.5.0-dev
+policy-controller=1.5.0-dev
+policy-controller-operator=1.5.0-dev
+rekor=1.5.0-dev
+rekor-monitor=1.5.0-dev
+rekor-search-ui=1.5.0-dev
+rhtas-console=1.5.0-dev
+rhtas-console-ui=1.5.0-dev
+secure-sign-operator=1.5.0-dev
+segment-backup-job=1.5.0-dev
+timestamp-authority=1.5.0-dev
+tough=1.5.0-dev
+trillian=1.5.0-dev
+tuf-server=1.5.0-dev

konflux-configs/base/project/base/ec/kustomization.yaml

@@ -20,6 +20,13 @@ patches:
       labelSelector: "build.rhtas.com/ec=registry-rhtas-operator"
     path: patch/registry-rhtas-operator.yaml
 
+  # For operator monorepos that inject cross-component digests into BUILD_ARGS.
+  # EC must run on the group snapshot so dependency digests are trusted.
+  - target:
+      kind: ProjectDevelopmentStreamTemplate
+      labelSelector: "build.rhtas.com/ec=registry-rhtas-operator-group-only"
+    path: patch/registry-rhtas-operator-group-only.yaml
+
   # For templates with build.rhtas.com/ec=fbc-standard (FBC patch)
   - target:
       kind: ProjectDevelopmentStreamTemplate

konflux-configs/base/project/base/ec/patch/registry-rhtas-operator-group-only.yaml

@@ -0,0 +1,27 @@
+- op: add
+  path: /spec/resources/-
+  value:
+    apiVersion: appstudio.redhat.com/v1beta2
+    kind: IntegrationTestScenario
+    metadata:
+      annotations:
+        test.appstudio.openshift.io/kind: enterprise-contract
+      name: "{{.application}}{{.nameSuffix}}-enterprise-contract-group"
+    spec:
+      application: "{{.application}}{{.nameSuffix}}"
+      contexts:
+        - description: execute the integration test for a Snapshot of the `group` type
+          name: group
+      params:
+        - name: POLICY_CONFIGURATION
+          value: rhtap-releng-tenant/registry-rhtas
+      resolverRef:
+        params:
+          - name: url
+            value: https://github.com/konflux-ci/build-definitions
+          - name: revision
+            value: main
+          - name: pathInRepo
+            value: pipelines/enterprise-contract.yaml
+        resolver: git
+        resourceKind: pipeline

konflux-configs/base/project/overlay/model-validation-operator/template.yaml

@@ -3,7 +3,7 @@ kind: ProjectDevelopmentStreamTemplate
 metadata:
   name: model-validation-operator-template
   labels:
-    build.rhtas.com/ec: registry-rhtas-operator
+    build.rhtas.com/ec: registry-rhtas-operator-group-only
     build.rhtas.com/type: operator
 spec:
   project: model-validation-operator

pipelines/bundle-build-oci-ta.yaml

@@ -200,6 +200,25 @@ spec:
       workspace: git-auth
     - name: netrc
       workspace: netrc
+  - name: get-version-from-configmap
+    taskRef:
+      resolver: git
+      params:
+      - name: url
+        value: "https://github.com/securesign/pipelines.git"
+      - name: revision
+        value: main
+      - name: pathInRepo
+        value: tasks/get-version-from-configmap.yaml
+    params:
+    - name: git-url
+      value: $(params.git-url)
+    - name: configmap-name
+      value: rhtas-repo-branch-versions
+    - name: configmap-namespace
+      value: $(context.pipelineRun.namespace)
+    - name: default-version
+      value: $(params.release-version)
   - name: derive-product-version
     taskRef:
       resolver: git
@@ -212,9 +231,11 @@ spec:
         value: tasks/derive-product-version.yaml
     params:
     - name: release-version
-      value: $(params.release-version)
+      value: $(tasks.get-version-from-configmap.results.release-version)
     - name: image-version
       value: $(params.image-version)
+    runAfter:
+    - get-version-from-configmap
   - name: generate-labels
     params:
     - name: label-templates

pipelines/docker-build-multi-platform-oci-ta.yaml

@@ -119,7 +119,7 @@ spec:
   - description: The Go base image used to run the unit tests
     name: go_base_image
     type: string
-    default: registry.redhat.io/ubi9/go-toolset@sha256:bed6eea46459b3afbe9c46de513172ab08001a8a846ad29c0d7b124d6f81eeba
+    default: registry.redhat.io/ubi9/go-toolset@sha256:35f08031de19eb51d6b35ed62c6357d3529bc69a8db65cf623ea5f0b44051999
   - name: enable-package-registry-proxy
     default: 'true'
     description: Use the package registry proxy when prefetching dependencies
@@ -218,6 +218,25 @@ spec:
       workspace: git-auth
     - name: netrc
       workspace: netrc
+  - name: get-version-from-configmap
+    taskRef:
+      resolver: git
+      params:
+      - name: url
+        value: "https://github.com/securesign/pipelines.git"
+      - name: revision
+        value: main
+      - name: pathInRepo
+        value: tasks/get-version-from-configmap.yaml
+    params:
+    - name: git-url
+      value: $(params.git-url)
+    - name: configmap-name
+      value: rhtas-repo-branch-versions
+    - name: configmap-namespace
+      value: $(context.pipelineRun.namespace)
+    - name: default-version
+      value: $(params.release-version)
   - name: derive-product-version
     taskRef:
       resolver: git
@@ -230,9 +249,11 @@ spec:
         value: tasks/derive-product-version.yaml
     params:
     - name: release-version
-      value: $(params.release-version)
+      value: $(tasks.get-version-from-configmap.results.release-version)
     - name: image-version
       value: $(params.image-version)
+    runAfter:
+    - get-version-from-configmap
   - name: generate-labels
     params:
     - name: label-templates