diff --git a/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc b/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc index 437aaf3fe..693982d63 100644 --- a/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc +++ b/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc @@ -62,8 +62,6 @@ paths can be provided by using the `:` separator. *Default*: `false` *EXTRA_RULE_DATA* (`string`):: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..." *POLICY_BUNDLE_DIGEST* (`string`):: Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...). -+ -*Default*: `sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2` *WORKERS* (`string`):: Number of parallel workers to use for policy evaluation. + diff --git a/docs/modules/ROOT/pages/verify-enterprise-contract.adoc b/docs/modules/ROOT/pages/verify-enterprise-contract.adoc index 5523113ce..30e15ca91 100644 --- a/docs/modules/ROOT/pages/verify-enterprise-contract.adoc +++ b/docs/modules/ROOT/pages/verify-enterprise-contract.adoc @@ -73,8 +73,6 @@ paths can be provided by using the `:` separator. *Default*: `false` *EXTRA_RULE_DATA* (`string`):: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..." *POLICY_BUNDLE_DIGEST* (`string`):: Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...). -+ -*Default*: `sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2` *WORKERS* (`string`):: Number of parallel workers to use for policy evaluation. + *Default*: `1` diff --git a/features/__snapshots__/ta_task_validate_image.snap b/features/__snapshots__/ta_task_validate_image.snap index 24d0d1e41..79f9e8895 100644 --- a/features/__snapshots__/ta_task_validate_image.snap +++ b/features/__snapshots__/ta_task_validate_image.snap @@ -1,7 +1,6 @@ [TestFeatures/Golden container image with trusted artifacts:pin-policy-bundle - 1] -Applying policy bundle digest override: sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2 -'oci::quay.io/conforma/release-policy:konflux' not found in policy configuration, nothing to do. +POLICY_BUNDLE_DIGEST is empty, skipping policy bundle digest override. --- diff --git a/features/__snapshots__/task_validate_image.snap b/features/__snapshots__/task_validate_image.snap index b1fb8ea1f..4e6582ca7 100644 --- a/features/__snapshots__/task_validate_image.snap +++ b/features/__snapshots__/task_validate_image.snap @@ -40,8 +40,7 @@ Error: Get "http://tuf.invalid/root.json": dial tcp: lookup tuf.invalid on 10.96 --- [TestFeatures/Golden container image:pin-policy-bundle - 1] -Applying policy bundle digest override: sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2 -'oci::quay.io/conforma/release-policy:konflux' not found in policy configuration, nothing to do. +POLICY_BUNDLE_DIGEST is empty, skipping policy bundle digest override. --- diff --git a/hack/update-policy-digest-in-tasks.sh b/hack/update-policy-digest-in-tasks.sh index 7e9ba337a..29037ec81 100755 --- a/hack/update-policy-digest-in-tasks.sh +++ b/hack/update-policy-digest-in-tasks.sh @@ -15,7 +15,8 @@ # # SPDX-License-Identifier: Apache-2.0 -# Update the POLICY_BUNDLE_DIGEST default value in tekton task definitions. +# Update the POLICY_BUNDLE_DIGEST default value in the enterprise-contract +# pipeline definition and related docs/tests. set -o errexit set -o nounset @@ -23,12 +24,11 @@ set -o pipefail IMAGE="${IMAGE:-"quay.io/conforma/release-policy:konflux"}" -# The two task definitions are the important placess where the digest -# should update, but it also appears in some tests, and in the docs. -# Update all those files as well so the change is ready to merge. +# The pipeline definition is the primary place where the digest default +# lives. The docs and test features also reference it and should be kept +# in sync. FILES=( - tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml - tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml + pipelines/enterprise-contract/0.1/enterprise-contract.yaml docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc docs/modules/ROOT/pages/verify-enterprise-contract.adoc features/__snapshots__/task_validate_image.snap diff --git a/pipelines/enterprise-contract/0.1/enterprise-contract.yaml b/pipelines/enterprise-contract/0.1/enterprise-contract.yaml index b2722455a..7e03420d6 100644 --- a/pipelines/enterprise-contract/0.1/enterprise-contract.yaml +++ b/pipelines/enterprise-contract/0.1/enterprise-contract.yaml @@ -79,6 +79,14 @@ spec: type: string description: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..." default: "" + - name: POLICY_BUNDLE_DIGEST + type: string + description: >- + OCI digest to pin the release policy bundle. The task resolves the + policy configuration and replaces oci::quay.io/conforma/release-policy:konflux + with oci::quay.io/conforma/release-policy@. + # To update this digest use the script in hack/update-policy-digest-in-tasks.sh + default: "sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2" - name: SINGLE_COMPONENT type: string description: Reduce the Snapshot to only the component whose build caused the Snapshot to be created @@ -154,6 +162,8 @@ spec: value: "$(params.CA_TRUST_CONFIG_MAP_KEY)" - name: EXTRA_RULE_DATA value: "$(params.EXTRA_RULE_DATA)" + - name: POLICY_BUNDLE_DIGEST + value: "$(params.POLICY_BUNDLE_DIGEST)" - name: SINGLE_COMPONENT value: "$(params.SINGLE_COMPONENT)" - name: SINGLE_COMPONENT_CUSTOM_RESOURCE diff --git a/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml b/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml index 019ecc9c1..cfbac464a 100644 --- a/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml +++ b/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml @@ -169,13 +169,7 @@ spec: oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...). - # For Konflux stability we want to try pinning the policy bundle rather - # than use the floating oci::quay.io/conforma/release-policy:konflux tag. - # Instead of needing to bump this in hundreds of separate ECPs, we'll do - # it here instead. If you don't want this behavior then provide an empty - # string value for this param. To update this digest use the script in - # hack/update-policy-digest-in-tasks.sh - default: "sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2" + default: "" - name: WORKERS type: string diff --git a/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml b/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml index 917372ef4..96b0f4143 100644 --- a/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml +++ b/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml @@ -176,13 +176,7 @@ spec: oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...). - # For Konflux stability we want to try pinning the policy bundle rather - # than use the floating oci::quay.io/conforma/release-policy:konflux tag. - # Instead of needing to bump this in hundreds of separate ECPs, we'll do - # it here instead. If you don't want this behavior then provide an empty - # string value for this param. To update this digest use the script in - # hack/update-policy-digest-in-tasks.sh - default: "sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2" + default: "" - name: WORKERS type: string