feat(RELEASE-1387): use ta for apply-mapping

Signed-off-by: Scott Hebert <[email protected]>
konflux-ci · Jan 24, 2025 · dbb58a3 · dbb58a3
1 parent a3f3224
commit dbb58a3
Show file tree

Hide file tree

Showing 18 changed files with 687 additions and 160 deletions.
diff --git a/tasks/managed/apply-mapping/apply-mapping.yaml b/tasks/managed/apply-mapping/apply-mapping.yaml
@@ -22,22 +22,44 @@ spec:
       type: string
       description: Fail the task if the resulting snapshot contains 0 components
       default: "false"
+    - name: ociStorage
+      description: The OCI repository where the Trusted Artifacts are stored.
+      type: string
+    - name: ociArtifactExpiresAfter
+      description: Expiration date for the trusted artifacts created in the
+        OCI repository. An empty string means the artifacts do not expire.
+      type: string
+      default: "1d"
+    - name: SOURCE_DATA_ARTIFACT
+      type: string
   workspaces:
-    - name: config
+    - name: data
       description: The workspace where the extra config file containing the mapping and snapshot json reside
   results:
     - name: mapped
       type: string
       description: A true/false value depicting whether or not the snapshot was mapped.
+    - description: Produced trusted data artifact
+      name: SOURCE_DATA_ARTIFACT
+      type: string
   steps:
+    - name: use-trusted-artifact
+      args:
+        - use
+        - $(params.SOURCE_DATA_ARTIFACT)=$(workspaces.data.path)
+      env:
+        - name: "ORAS_OPTIONS"
+          value: "--insecure"
+      computeResources: {}
+      image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:ff35e09ff5c89e54538b50abae241a765b2b7868f05d62c4835bebf0978f3659
     - name: apply-mapping
       image: quay.io/konflux-ci/release-service-utils:d320c36f3d707cd5bfe55fe783f70236c06cc2e5
       script: |
         #!/usr/bin/env bash
         set -eux
 
-        SNAPSHOT_SPEC_FILE="$(workspaces.config.path)/$(params.snapshotPath)"
-        DATA_FILE="$(workspaces.config.path)/$(params.dataPath)"
+        SNAPSHOT_SPEC_FILE="$(workspaces.data.path)/$(params.snapshotPath)"
+        DATA_FILE="$(workspaces.data.path)/$(params.dataPath)"
         SNAPSHOT_SPEC_FILE_ORIG="${SNAPSHOT_SPEC_FILE}.orig"
 
         if [ ! -f "${SNAPSHOT_SPEC_FILE}" ] ; then
@@ -353,3 +375,16 @@ spec:
               "${SNAPSHOT_SPEC_FILE}" > /tmp/temp && mv /tmp/temp "${SNAPSHOT_SPEC_FILE}"
             fi
         done
+    - name: create-trusted-artifact
+      args:
+        - create
+        - --store
+        - $(params.ociStorage)
+        - $(results.SOURCE_DATA_ARTIFACT.path)=$(workspaces.data.path)
+      computeResources: {}
+      image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:ff35e09ff5c89e54538b50abae241a765b2b7868f05d62c4835bebf0978f3659
+      env:
+        - name: IMAGE_EXPIRES_AFTER
+          value: $(params.ociArtifactExpiresAfter)
+        - name: "ORAS_OPTIONS"
+          value: "--insecure"
diff --git a/tasks/managed/apply-mapping/tests/mocks.sh b/tasks/managed/apply-mapping/tests/mocks.sh
@@ -4,7 +4,7 @@ set -eux
 # mocks to be injected into task step scripts
 
 function date() {
-  echo $* >> $(workspaces.config.path)/mock_date.txt
+  echo $* >> $(workspaces.data.path)/mock_date.txt
 
   case "$*" in
       *"2024-07-29T02:17:29 +%Y-%m-%d")
@@ -31,7 +31,7 @@ function date() {
 
 function skopeo() {
   echo Mock skopeo called with: $* >&2
-  echo $* >> $(workspaces.config.path)/mock_skopeo.txt
+  echo $* >> $(workspaces.data.path)/mock_skopeo.txt
 
   if [[ "$*" =~ list-tags\ docker://repo1 ]]; then
       echo '{"Tags": ["v2.0.0-4", "v2.0.0-3", "v2.0.0-2"]}'

diff --git a/tasks/managed/apply-mapping/tests/pre-apply-task-hook.sh b/tasks/managed/apply-mapping/tests/pre-apply-task-hook.sh
@@ -4,4 +4,4 @@ TASK_PATH="$1"
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 
 # Add mocks to the beginning of task step script
-yq -i '.spec.steps[0].script = load_str("'$SCRIPT_DIR'/mocks.sh") + .spec.steps[0].script' "$TASK_PATH"
+yq -i '.spec.steps[1].script = load_str("'$SCRIPT_DIR'/mocks.sh") + .spec.steps[1].script' "$TASK_PATH"
diff --git a/tasks/managed/apply-mapping/tests/test-apply-mapping-content-gateway-disabled.yaml b/tasks/managed/apply-mapping/tests/test-apply-mapping-content-gateway-disabled.yaml
@@ -10,22 +10,29 @@ spec:
     for the component.
   workspaces:
     - name: tests-workspace
+  params:
+    - name: ociStorage
+      description: The OCI repository where the Trusted Artifacts are stored.
+      type: string
   tasks:
     - name: setup
       workspaces:
-        - name: config
+        - name: data
           workspace: tests-workspace
       taskSpec:
+        results:
+          - name: SOURCE_DATA_ARTIFACT
+            type: string
         workspaces:
-          - name: config
+          - name: data
         steps:
           - name: setup-values
             image: quay.io/konflux-ci/release-service-utils:d320c36f3d707cd5bfe55fe783f70236c06cc2e5
             script: |
               #!/usr/bin/env sh
               set -eux
 
-              cat > "$(workspaces.config.path)/test_data.json" << EOF
+              cat > "$(workspaces.data.path)/test_data.json" << EOF
               {
                 "mapping": {
                   "components": [
@@ -37,7 +44,7 @@ spec:
               }
               EOF
 
-              cat > "$(workspaces.config.path)/test_snapshot_spec.json" << EOF
+              cat > "$(workspaces.data.path)/test_snapshot_spec.json" << EOF
               {
                 "application": "myapp",
                 "components": [
@@ -54,6 +61,19 @@ spec:
                 ]
               }
               EOF
+          - name: create-trusted-artifact
+            args:
+              - create
+              - --store
+              - $(params.ociStorage)
+              - $(results.SOURCE_DATA_ARTIFACT.path)=$(workspaces.data.path)
+            computeResources: { }
+            image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:ff35e09ff5c89e54538b50abae241a765b2b7868f05d62c4835bebf0978f3659
+            env:
+              - name: IMAGE_EXPIRES_AFTER
+                value: 1d
+              - name: "ORAS_OPTIONS"
+                value: "--insecure"
     - name: run-task
       taskRef:
         name: apply-mapping
@@ -62,32 +82,50 @@ spec:
           value: test_snapshot_spec.json
         - name: dataPath
           value: test_data.json
+        - name: ociStorage
+          value: $(params.ociStorage)
+        - name: SOURCE_DATA_ARTIFACT
+          value: "$(tasks.setup.results.SOURCE_DATA_ARTIFACT)=$(workspaces.data.path)"
       runAfter:
         - setup
       workspaces:
-        - name: config
+        - name: data
           workspace: tests-workspace
     - name: check-result
       workspaces:
-        - name: config
+        - name: data
           workspace: tests-workspace
+      params:
+        - name: SOURCE_DATA_ARTIFACT
+          value: "$(tasks.run-task.results.SOURCE_DATA_ARTIFACT)=$(workspaces.data.path)"
+      runAfter:
+        - run-task
       taskSpec:
         workspaces:
-          - name: config
+          - name: data
+        params:
+          - name: SOURCE_DATA_ARTIFACT
+            type: string
         steps:
+          - name: use-trusted-artifact
+            args:
+              - use
+              - $(params.SOURCE_DATA_ARTIFACT)=$(workspaces.data.path)
+            env:
+              - name: "ORAS_OPTIONS"
+                value: "--insecure"
+            computeResources: {}
+            image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:ff35e09ff5c89e54538b50abae241a765b2b7868f05d62c4835bebf0978f3659
           - name: check-result
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
               #!/usr/bin/env bash
               set -eux
 
-              cat "$(workspaces.config.path)/test_snapshot_spec.json"
+              cat "$(workspaces.data.path)/test_snapshot_spec.json"
 
               echo Test that comp1 has NO contentGateway data
               test "$(
                 jq -c '.components[] | select(.name=="comp1") | has("contentGateway")' \
-                < "$(workspaces.config.path)/test_snapshot_spec.json"
+                < "$(workspaces.data.path)/test_snapshot_spec.json"
               )" == "false"
-
-      runAfter:
-        - run-task
diff --git a/tasks/managed/apply-mapping/tests/test-apply-mapping-content-gateway-with-defaults.yaml b/tasks/managed/apply-mapping/tests/test-apply-mapping-content-gateway-with-defaults.yaml
@@ -9,22 +9,29 @@ spec:
     validate that the values are overridden if defined in the component or if not defined then the defaults are used.
   workspaces:
     - name: tests-workspace
+  params:
+    - name: ociStorage
+      description: The OCI repository where the Trusted Artifacts are stored.
+      type: string
   tasks:
     - name: setup
       workspaces:
-        - name: config
+        - name: data
           workspace: tests-workspace
       taskSpec:
+        results:
+          - name: SOURCE_DATA_ARTIFACT
+            type: string
         workspaces:
-          - name: config
+          - name: data
         steps:
           - name: setup-values
             image: quay.io/konflux-ci/release-service-utils:d320c36f3d707cd5bfe55fe783f70236c06cc2e5
             script: |
               #!/usr/bin/env sh
               set -eux
 
-              cat > "$(workspaces.config.path)/test_data.json" << EOF
+              cat > "$(workspaces.data.path)/test_data.json" << EOF
               {
                 "mapping": {
                   "defaults": {
@@ -87,7 +94,7 @@ spec:
               }
               EOF
 
-              cat > "$(workspaces.config.path)/test_snapshot_spec.json" << EOF
+              cat > "$(workspaces.data.path)/test_snapshot_spec.json" << EOF
               {
                 "application": "myapp",
                 "components": [
@@ -124,6 +131,19 @@ spec:
                 ]
               }
               EOF
+          - name: create-trusted-artifact
+            args:
+              - create
+              - --store
+              - $(params.ociStorage)
+              - $(results.SOURCE_DATA_ARTIFACT.path)=$(workspaces.data.path)
+            computeResources: { }
+            image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:ff35e09ff5c89e54538b50abae241a765b2b7868f05d62c4835bebf0978f3659
+            env:
+              - name: IMAGE_EXPIRES_AFTER
+                value: 1d
+              - name: "ORAS_OPTIONS"
+                value: "--insecure"
     - name: run-task
       taskRef:
         name: apply-mapping
@@ -132,43 +152,62 @@ spec:
           value: test_snapshot_spec.json
         - name: dataPath
           value: test_data.json
+        - name: ociStorage
+          value: $(params.ociStorage)
+        - name: SOURCE_DATA_ARTIFACT
+          value: "$(tasks.setup.results.SOURCE_DATA_ARTIFACT)=$(workspaces.data.path)"
       runAfter:
         - setup
       workspaces:
-        - name: config
+        - name: data
           workspace: tests-workspace
     - name: check-result
       workspaces:
-        - name: config
+        - name: data
           workspace: tests-workspace
+      params:
+        - name: SOURCE_DATA_ARTIFACT
+          value: "$(tasks.run-task.results.SOURCE_DATA_ARTIFACT)=$(workspaces.data.path)"
+      runAfter:
+        - run-task
       taskSpec:
         workspaces:
-          - name: config
+          - name: data
+        params:
+          - name: SOURCE_DATA_ARTIFACT
+            type: string
         steps:
+          - name: use-trusted-artifact
+            args:
+              - use
+              - $(params.SOURCE_DATA_ARTIFACT)=$(workspaces.data.path)
+            env:
+              - name: "ORAS_OPTIONS"
+                value: "--insecure"
+            computeResources: {}
+            image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:ff35e09ff5c89e54538b50abae241a765b2b7868f05d62c4835bebf0978f3659
           - name: check-result
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
               #!/usr/bin/env bash
               set -eux
 
-              cat "$(workspaces.config.path)/test_snapshot_spec.json"
+              cat "$(workspaces.data.path)/test_snapshot_spec.json"
 
               echo Test that comp1 has the correct contentGateway.productVersionName
               test "$(
                 jq -r '.components[] | select(.name=="comp1") | .contentGateway.productVersionName' \
-                < "$(workspaces.config.path)/test_snapshot_spec.json"
+                < "$(workspaces.data.path)/test_snapshot_spec.json"
               )" == "comp1-1"
 
               echo Test that comp2 has the correct contentGateway.filePrefix
               test "$(
                 jq -r '.components[] | select(.name=="comp2") | .contentGateway.filePrefix' \
-                < "$(workspaces.config.path)/test_snapshot_spec.json"
+                < "$(workspaces.data.path)/test_snapshot_spec.json"
               )" == "myapp-comp1-1"
   
               echo Test that comp3 has the correct contentGateway defaults
               test "$(
                 jq -c '.components[] | select(.name=="comp3") | .contentGateway' \
-                < "$(workspaces.config.path)/test_snapshot_spec.json"
+                < "$(workspaces.data.path)/test_snapshot_spec.json"
               )" == '{"productName":"myapp","productCode":"MYAPP","productVersionName":"1.0","filePrefix":"myapp-1.3"}'
-      runAfter:
-        - run-task