diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 8be05f0b..e201329c 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,60 +1,35 @@ --- -# CI for fedora-bootc base images. -# -# All build and test logic lives in the Justfile so that CI flows -# are easily replicable locally: just install `just` and run the -# same targets that CI does. -workflow: - rules: - # Skip CI if only non-build files changed - - changes: - - renovate.json - - README.md - - LICENSE - - .tekton/* - when: never - - when: always - stages: - build variables: - BUILDER: buildah - JUST_VERSION: "1.49.0" + PRIV_ARGS: "--security-opt=label=disable --cap-add=all --device /dev/fuse" .build-image: stage: build - image: quay.io/buildah/stable:v1.42.2 + image: quay.io/buildah/stable:v1.38.0 needs: [] - before_script: - # just is not packaged in the buildah image; grab a pinned static binary - - curl -sSfL -o /tmp/just.tar.gz "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz" - - tar -xzf /tmp/just.tar.gz -C /usr/local/bin just -basic-checks: - stage: build - image: quay.io/fedora/fedora:latest - needs: [] +build-minimal: + extends: .build-image script: | set -xeuo pipefail - dnf install -y file jq python3-yaml ShellCheck just - just validate + buildah build -f Containerfile --no-cache -t localhost/fedora-bootc:minimal ${PRIV_ARGS} --build-arg=manifest=fedora-minimal . + cd tests/rootfs && buildah build -t localhost/test --from localhost/fedora-bootc:minimal -# Test each tier against rawhide and the latest stable release -build-and-test: +build-minimal-plus: extends: .build-image - parallel: - matrix: - - FEDORA_VERSION: [rawhide, "44"] - TIER: [minimal, minimal-plus, standard] - script: - - just test + script: | + set -xeuo pipefail + buildah build -f Containerfile --no-cache -t localhost/fedora-bootc:minimal-plus ${PRIV_ARGS} --build-arg=manifest=fedora-minimal-plus . + cd tests/rootfs && buildah build -t localhost/test --from localhost/fedora-bootc:minimal-plus -# Smoke-test older Fedora versions (standard tier, build only) -build-fedora-version: + +standard-build-and-test: extends: .build-image - parallel: - matrix: - - FEDORA_VERSION: ["43"] - script: - - just build + script: | + set -xeuo pipefail + buildah build --no-cache -t localhost/fedora-bootc ${PRIV_ARGS} . + (cd tests/rootfs && buildah build -t localhost/test --from localhost/fedora-bootc) + cd tests + buildah build -f Containerfile.test-derive --no-cache -t localhost/fedora-bootc-derived ${PRIV_ARGS} . diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 6383196a..0934aaf9 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,7 +1,7 @@ --- repos: - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v6.0.0 + rev: v4.6.0 hooks: - id: end-of-file-fixer - id: trailing-whitespace @@ -22,6 +22,6 @@ repos: - id: check-json - id: check-yaml - repo: https://github.com/markdownlint/markdownlint - rev: v0.15.0 + rev: v0.13.0 hooks: - id: markdownlint diff --git a/.tekton/fedora-bootc-43-iot-pull-request.yaml b/.tekton/fedora-bootc-43-iot-pull-request.yaml deleted file mode 100644 index 50f8bc0c..00000000 --- a/.tekton/fedora-bootc-43-iot-pull-request.yaml +++ /dev/null @@ -1,73 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-43-iot-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "iot.yaml".pathChanged() || - "iot/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-43 - appstudio.openshift.io/component: fedora-bootc-43-iot - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-43-iot-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20261023.0@sha256:6a96a4f0d1d39a9023cd6b7bc1a40998af31fe2161f4b2606a43359e3ecbfeb6 - - MANIFEST=fedora-iot - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-iot:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=43 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-43-iot diff --git a/.tekton/fedora-bootc-43-iot-push.yaml b/.tekton/fedora-bootc-43-iot-push.yaml deleted file mode 100644 index 5eece657..00000000 --- a/.tekton/fedora-bootc-43-iot-push.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-43-iot-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "iot.yaml".pathChanged() || - "iot/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-43 - appstudio.openshift.io/component: fedora-bootc-43-iot - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-43-iot-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20261023.0@sha256:6a96a4f0d1d39a9023cd6b7bc1a40998af31fe2161f4b2606a43359e3ecbfeb6 - - MANIFEST=fedora-iot - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-iot:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=43 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-43-iot diff --git a/.tekton/fedora-bootc-43-iot-renovate-push.yaml b/.tekton/fedora-bootc-43-iot-renovate-push.yaml deleted file mode 100644 index bdb5b840..00000000 --- a/.tekton/fedora-bootc-43-iot-renovate-push.yaml +++ /dev/null @@ -1,73 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch.startsWith("renovate/")) - ) && ( - ".tekton/fedora-bootc-43-iot-renovate-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "iot.yaml".pathChanged() || - "iot/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-43 - appstudio.openshift.io/component: fedora-bootc-43-iot - pipelines.appstudio.openshift.io/type: build - release.appstudio.openshift.io/auto-release: "false" - name: fedora-bootc-43-iot-renovate-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20261023.0@sha256:6a96a4f0d1d39a9023cd6b7bc1a40998af31fe2161f4b2606a43359e3ecbfeb6 - - MANIFEST=fedora-iot - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-iot:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=43 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-43-iot diff --git a/.tekton/fedora-bootc-43-minimal-plus-pull-request.yaml b/.tekton/fedora-bootc-43-minimal-plus-pull-request.yaml deleted file mode 100644 index 072c2e51..00000000 --- a/.tekton/fedora-bootc-43-minimal-plus-pull-request.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-43-minimal-plus-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-43 - appstudio.openshift.io/component: fedora-bootc-43-minimal-plus - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-43-minimal-plus-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20261023.0@sha256:6a96a4f0d1d39a9023cd6b7bc1a40998af31fe2161f4b2606a43359e3ecbfeb6 - - MANIFEST=fedora-minimal-plus - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal-plus:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=43 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-43-minimal-plus diff --git a/.tekton/fedora-bootc-43-minimal-plus-push.yaml b/.tekton/fedora-bootc-43-minimal-plus-push.yaml deleted file mode 100644 index a687beae..00000000 --- a/.tekton/fedora-bootc-43-minimal-plus-push.yaml +++ /dev/null @@ -1,69 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-43-minimal-plus-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-43 - appstudio.openshift.io/component: fedora-bootc-43-minimal-plus - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-43-minimal-plus-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20261023.0@sha256:6a96a4f0d1d39a9023cd6b7bc1a40998af31fe2161f4b2606a43359e3ecbfeb6 - - MANIFEST=fedora-minimal-plus - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal-plus:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=43 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-43-minimal-plus diff --git a/.tekton/fedora-bootc-43-minimal-pull-request.yaml b/.tekton/fedora-bootc-43-minimal-pull-request.yaml deleted file mode 100644 index bfa79e5a..00000000 --- a/.tekton/fedora-bootc-43-minimal-pull-request.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-43-minimal-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-43 - appstudio.openshift.io/component: fedora-bootc-43-minimal - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-43-minimal-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20261023.0@sha256:6a96a4f0d1d39a9023cd6b7bc1a40998af31fe2161f4b2606a43359e3ecbfeb6 - - MANIFEST=fedora-minimal - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=43 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-43-minimal diff --git a/.tekton/fedora-bootc-43-minimal-push.yaml b/.tekton/fedora-bootc-43-minimal-push.yaml deleted file mode 100644 index ff013b55..00000000 --- a/.tekton/fedora-bootc-43-minimal-push.yaml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-43-minimal-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-43 - appstudio.openshift.io/component: fedora-bootc-43-minimal - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-43-minimal-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20261023.0@sha256:6a96a4f0d1d39a9023cd6b7bc1a40998af31fe2161f4b2606a43359e3ecbfeb6 - - MANIFEST=fedora-minimal - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=43 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-43-minimal diff --git a/.tekton/fedora-bootc-43-standard-pull-request.yaml b/.tekton/fedora-bootc-43-standard-pull-request.yaml deleted file mode 100644 index e219d89c..00000000 --- a/.tekton/fedora-bootc-43-standard-pull-request.yaml +++ /dev/null @@ -1,74 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-43-standard-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "standard.yaml".pathChanged() || - "standard/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-43 - appstudio.openshift.io/component: fedora-bootc-43-standard - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-43-standard-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20261023.0@sha256:6a96a4f0d1d39a9023cd6b7bc1a40998af31fe2161f4b2606a43359e3ecbfeb6 - - MANIFEST=fedora-standard - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-standard:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=43 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-43-standard diff --git a/.tekton/fedora-bootc-43-standard-push.yaml b/.tekton/fedora-bootc-43-standard-push.yaml deleted file mode 100644 index cdbdd1f7..00000000 --- a/.tekton/fedora-bootc-43-standard-push.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-43-standard-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "standard.yaml".pathChanged() || - "standard/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-43 - appstudio.openshift.io/component: fedora-bootc-43-standard - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-43-standard-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20261023.0@sha256:6a96a4f0d1d39a9023cd6b7bc1a40998af31fe2161f4b2606a43359e3ecbfeb6 - - MANIFEST=fedora-standard - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-standard:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=43 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-43-standard diff --git a/.tekton/fedora-bootc-44-iot-pull-request.yaml b/.tekton/fedora-bootc-44-iot-pull-request.yaml deleted file mode 100644 index e1845490..00000000 --- a/.tekton/fedora-bootc-44-iot-pull-request.yaml +++ /dev/null @@ -1,73 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-44-iot-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "iot.yaml".pathChanged() || - "iot/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-44 - appstudio.openshift.io/component: fedora-bootc-44-iot - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-44-iot-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-20260209.n.0@sha256:c947e0988e3f00078d3ff59eaff5ee18fe1d6fd39dc1fd15d268de0d074df45f - - MANIFEST=fedora-iot - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-iot:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=44 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-44-iot diff --git a/.tekton/fedora-bootc-44-iot-push.yaml b/.tekton/fedora-bootc-44-iot-push.yaml deleted file mode 100644 index 3d39c405..00000000 --- a/.tekton/fedora-bootc-44-iot-push.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-44-iot-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "iot.yaml".pathChanged() || - "iot/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-44 - appstudio.openshift.io/component: fedora-bootc-44-iot - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-44-iot-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-20260209.n.0@sha256:c947e0988e3f00078d3ff59eaff5ee18fe1d6fd39dc1fd15d268de0d074df45f - - MANIFEST=fedora-iot - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-iot:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=44 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-44-iot diff --git a/.tekton/fedora-bootc-44-minimal-plus-pull-request.yaml b/.tekton/fedora-bootc-44-minimal-plus-pull-request.yaml deleted file mode 100644 index fb2cd893..00000000 --- a/.tekton/fedora-bootc-44-minimal-plus-pull-request.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-44-minimal-plus-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-44 - appstudio.openshift.io/component: fedora-bootc-44-minimal-plus - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-44-minimal-plus-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20261023.0@sha256:b38dad99253b7c9a5edb7d6cb88177b78c84fd0753b375cf272a3e7a19d239ac - - MANIFEST=fedora-minimal-plus - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal-plus:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=44 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-44-minimal-plus diff --git a/.tekton/fedora-bootc-44-minimal-plus-push.yaml b/.tekton/fedora-bootc-44-minimal-plus-push.yaml deleted file mode 100644 index 0d9bbf86..00000000 --- a/.tekton/fedora-bootc-44-minimal-plus-push.yaml +++ /dev/null @@ -1,69 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-44-minimal-plus-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-44 - appstudio.openshift.io/component: fedora-bootc-44-minimal-plus - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-44-minimal-plus-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20261023.0@sha256:b38dad99253b7c9a5edb7d6cb88177b78c84fd0753b375cf272a3e7a19d239ac - - MANIFEST=fedora-minimal-plus - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal-plus:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=44 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-44-minimal-plus diff --git a/.tekton/fedora-bootc-44-minimal-pull-request.yaml b/.tekton/fedora-bootc-44-minimal-pull-request.yaml deleted file mode 100644 index dbe64c6c..00000000 --- a/.tekton/fedora-bootc-44-minimal-pull-request.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-44-minimal-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-44 - appstudio.openshift.io/component: fedora-bootc-44-minimal - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-44-minimal-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20261023.0@sha256:b38dad99253b7c9a5edb7d6cb88177b78c84fd0753b375cf272a3e7a19d239ac - - MANIFEST=fedora-minimal - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=44 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-44-minimal diff --git a/.tekton/fedora-bootc-44-minimal-push.yaml b/.tekton/fedora-bootc-44-minimal-push.yaml deleted file mode 100644 index 6fe691ec..00000000 --- a/.tekton/fedora-bootc-44-minimal-push.yaml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-44-minimal-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-44 - appstudio.openshift.io/component: fedora-bootc-44-minimal - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-44-minimal-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20261023.0@sha256:b38dad99253b7c9a5edb7d6cb88177b78c84fd0753b375cf272a3e7a19d239ac - - MANIFEST=fedora-minimal - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=44 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-44-minimal diff --git a/.tekton/fedora-bootc-44-standard-pull-request.yaml b/.tekton/fedora-bootc-44-standard-pull-request.yaml deleted file mode 100644 index 7f1e771e..00000000 --- a/.tekton/fedora-bootc-44-standard-pull-request.yaml +++ /dev/null @@ -1,74 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-44-standard-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "standard.yaml".pathChanged() || - "standard/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-44 - appstudio.openshift.io/component: fedora-bootc-44-standard - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-44-standard-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20261023.0@sha256:b38dad99253b7c9a5edb7d6cb88177b78c84fd0753b375cf272a3e7a19d239ac - - MANIFEST=fedora-standard - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-standard:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=44 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-44-standard diff --git a/.tekton/fedora-bootc-44-standard-push.yaml b/.tekton/fedora-bootc-44-standard-push.yaml deleted file mode 100644 index 912c7be6..00000000 --- a/.tekton/fedora-bootc-44-standard-push.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-44-standard-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "standard.yaml".pathChanged() || - "standard/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-44 - appstudio.openshift.io/component: fedora-bootc-44-standard - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-44-standard-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20261023.0@sha256:b38dad99253b7c9a5edb7d6cb88177b78c84fd0753b375cf272a3e7a19d239ac - - MANIFEST=fedora-standard - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-standard:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=44 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1cc52ef828dc0b1671c68d647d5a8705907eaead253b16b85537a900483aaed9 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-44-standard diff --git a/.tekton/fedora-bootc-45-iot-pull-request.yaml b/.tekton/fedora-bootc-45-iot-pull-request.yaml deleted file mode 100644 index 04757882..00000000 --- a/.tekton/fedora-bootc-45-iot-pull-request.yaml +++ /dev/null @@ -1,73 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-45-iot-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "iot.yaml".pathChanged() || - "iot/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-45 - appstudio.openshift.io/component: fedora-bootc-45-iot - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-45-iot-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf - - MANIFEST=fedora-iot - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-iot:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=45 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-45-iot diff --git a/.tekton/fedora-bootc-45-iot-push.yaml b/.tekton/fedora-bootc-45-iot-push.yaml deleted file mode 100644 index 65e63700..00000000 --- a/.tekton/fedora-bootc-45-iot-push.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-45-iot-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "iot.yaml".pathChanged() || - "iot/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-45 - appstudio.openshift.io/component: fedora-bootc-45-iot - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-45-iot-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf - - MANIFEST=fedora-iot - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-iot:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=45 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-45-iot diff --git a/.tekton/fedora-bootc-45-minimal-plus-pull-request.yaml b/.tekton/fedora-bootc-45-minimal-plus-pull-request.yaml deleted file mode 100644 index e84ab01c..00000000 --- a/.tekton/fedora-bootc-45-minimal-plus-pull-request.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-45-minimal-plus-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-45 - appstudio.openshift.io/component: fedora-bootc-45-minimal-plus - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-45-minimal-plus-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20261024.n.0@sha256:cc256e6f9068d23c42a10e28068fc81de14e1336cc4a8fb13e04957657b93d54 - - MANIFEST=fedora-minimal-plus - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal-plus:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=45 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-45-minimal-plus diff --git a/.tekton/fedora-bootc-45-minimal-plus-push.yaml b/.tekton/fedora-bootc-45-minimal-plus-push.yaml deleted file mode 100644 index d1b7a072..00000000 --- a/.tekton/fedora-bootc-45-minimal-plus-push.yaml +++ /dev/null @@ -1,69 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-45-minimal-plus-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-45 - appstudio.openshift.io/component: fedora-bootc-45-minimal-plus - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-45-minimal-plus-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20261024.n.0@sha256:cc256e6f9068d23c42a10e28068fc81de14e1336cc4a8fb13e04957657b93d54 - - MANIFEST=fedora-minimal-plus - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal-plus:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=45 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-45-minimal-plus diff --git a/.tekton/fedora-bootc-45-minimal-pull-request.yaml b/.tekton/fedora-bootc-45-minimal-pull-request.yaml deleted file mode 100644 index f73dfe4b..00000000 --- a/.tekton/fedora-bootc-45-minimal-pull-request.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-45-minimal-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-45 - appstudio.openshift.io/component: fedora-bootc-45-minimal - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-45-minimal-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20261024.n.0@sha256:cc256e6f9068d23c42a10e28068fc81de14e1336cc4a8fb13e04957657b93d54 - - MANIFEST=fedora-minimal - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=45 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-45-minimal diff --git a/.tekton/fedora-bootc-45-minimal-push.yaml b/.tekton/fedora-bootc-45-minimal-push.yaml deleted file mode 100644 index 99c31a0d..00000000 --- a/.tekton/fedora-bootc-45-minimal-push.yaml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-45-minimal-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-45 - appstudio.openshift.io/component: fedora-bootc-45-minimal - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-45-minimal-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20261024.n.0@sha256:cc256e6f9068d23c42a10e28068fc81de14e1336cc4a8fb13e04957657b93d54 - - MANIFEST=fedora-minimal - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=45 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-45-minimal diff --git a/.tekton/fedora-bootc-45-standard-pull-request.yaml b/.tekton/fedora-bootc-45-standard-pull-request.yaml deleted file mode 100644 index 23b3e1f1..00000000 --- a/.tekton/fedora-bootc-45-standard-pull-request.yaml +++ /dev/null @@ -1,74 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-45-standard-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "standard.yaml".pathChanged() || - "standard/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-45 - appstudio.openshift.io/component: fedora-bootc-45-standard - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-45-standard-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20261024.n.0@sha256:cc256e6f9068d23c42a10e28068fc81de14e1336cc4a8fb13e04957657b93d54 - - MANIFEST=fedora-standard - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-standard:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=45 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-45-standard diff --git a/.tekton/fedora-bootc-45-standard-push.yaml b/.tekton/fedora-bootc-45-standard-push.yaml deleted file mode 100644 index 1bc5b864..00000000 --- a/.tekton/fedora-bootc-45-standard-push.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-45-standard-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "standard.yaml".pathChanged() || - "standard/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-45 - appstudio.openshift.io/component: fedora-bootc-45-standard - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-45-standard-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20261024.n.0@sha256:cc256e6f9068d23c42a10e28068fc81de14e1336cc4a8fb13e04957657b93d54 - - MANIFEST=fedora-standard - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-standard:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=45 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-45-standard diff --git a/.tekton/fedora-bootc-eln-standard-pull-request.yaml b/.tekton/fedora-bootc-eln-standard-pull-request.yaml deleted file mode 100644 index c74eb93c..00000000 --- a/.tekton/fedora-bootc-eln-standard-pull-request.yaml +++ /dev/null @@ -1,76 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-eln-standard-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/eln.yaml".pathChanged() || - "fedora-eln.yaml".pathChanged() || - "eln/***".pathChanged() || - "standard.yaml".pathChanged() || - "standard/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-eln - appstudio.openshift.io/component: fedora-bootc-eln-standard - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-eln-standard-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-eln-compose:Fedora-eln-20261021.n.0@sha256:0cd423e0c0b5c6c9022ee0521b7d35fd4294b53b62e0a0ab658ab9615596f695 - - MANIFEST=fedora-eln - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-eln-standard:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=eln - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:68875b7cfb79e343db882ae339dfbc2cce8c0aa6ccd77ec9486f070c05ddb9e0 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-eln-standard diff --git a/.tekton/fedora-bootc-eln-standard-push.yaml b/.tekton/fedora-bootc-eln-standard-push.yaml deleted file mode 100644 index 1e6cec31..00000000 --- a/.tekton/fedora-bootc-eln-standard-push.yaml +++ /dev/null @@ -1,73 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-eln-standard-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/eln.yaml".pathChanged() || - "fedora-eln.yaml".pathChanged() || - "eln/***".pathChanged() || - "standard.yaml".pathChanged() || - "standard/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-eln - appstudio.openshift.io/component: fedora-bootc-eln-standard - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-eln-standard-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-eln-compose:Fedora-eln-20261021.n.0@sha256:0cd423e0c0b5c6c9022ee0521b7d35fd4294b53b62e0a0ab658ab9615596f695 - - MANIFEST=fedora-eln - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-eln-standard:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=eln - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:68875b7cfb79e343db882ae339dfbc2cce8c0aa6ccd77ec9486f070c05ddb9e0 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-eln-standard diff --git a/.tekton/fedora-bootc-eln-standard-renovate-push.yaml b/.tekton/fedora-bootc-eln-standard-renovate-push.yaml deleted file mode 100644 index 63fae7a4..00000000 --- a/.tekton/fedora-bootc-eln-standard-renovate-push.yaml +++ /dev/null @@ -1,76 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch.startsWith("renovate/")) - ) && ( - ".tekton/fedora-bootc-eln-standard-renovate-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/eln.yaml".pathChanged() || - "fedora-eln.yaml".pathChanged() || - "eln/***".pathChanged() || - "standard.yaml".pathChanged() || - "standard/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() - ) && true == false - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-eln - appstudio.openshift.io/component: fedora-bootc-eln-standard - pipelines.appstudio.openshift.io/type: build - release.appstudio.openshift.io/auto-release: "false" - name: fedora-bootc-eln-standard-renovate-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-eln-compose:Fedora-eln-20261021.n.0@sha256:0cd423e0c0b5c6c9022ee0521b7d35fd4294b53b62e0a0ab658ab9615596f695 - - MANIFEST=fedora-eln - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-eln-standard:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=eln - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:68875b7cfb79e343db882ae339dfbc2cce8c0aa6ccd77ec9486f070c05ddb9e0 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-eln-standard diff --git a/.tekton/fedora-bootc-rawhide-iot-pull-request.yaml b/.tekton/fedora-bootc-rawhide-iot-pull-request.yaml deleted file mode 100644 index b351374a..00000000 --- a/.tekton/fedora-bootc-rawhide-iot-pull-request.yaml +++ /dev/null @@ -1,73 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-rawhide-iot-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "iot.yaml".pathChanged() || - "iot/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-rawhide - appstudio.openshift.io/component: fedora-bootc-rawhide-iot - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-rawhide-iot-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260209.n.0@sha256:a46fca7ce98fd36b5edb6ef96867de573479af69c645801cdc8c53ad6708114c - - MANIFEST=fedora-iot - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-iot:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=46 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-rawhide-iot diff --git a/.tekton/fedora-bootc-rawhide-iot-push.yaml b/.tekton/fedora-bootc-rawhide-iot-push.yaml deleted file mode 100644 index 89e9523a..00000000 --- a/.tekton/fedora-bootc-rawhide-iot-push.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-rawhide-iot-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "iot.yaml".pathChanged() || - "iot/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-rawhide - appstudio.openshift.io/component: fedora-bootc-rawhide-iot - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-rawhide-iot-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260209.n.0@sha256:a46fca7ce98fd36b5edb6ef96867de573479af69c645801cdc8c53ad6708114c - - MANIFEST=fedora-iot - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-iot:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=46 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51 - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-rawhide-iot diff --git a/.tekton/fedora-bootc-rawhide-minimal-plus-pull-request.yaml b/.tekton/fedora-bootc-rawhide-minimal-plus-pull-request.yaml index a4b3082d..590f4426 100644 --- a/.tekton/fedora-bootc-rawhide-minimal-plus-pull-request.yaml +++ b/.tekton/fedora-bootc-rawhide-minimal-plus-pull-request.yaml @@ -8,65 +8,584 @@ metadata: build.appstudio.redhat.com/target_branch: '{{target_branch}}' pipelinesascode.tekton.dev/cancel-in-progress: "true" pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-rawhide-minimal-plus-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" + pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch + == "main" creationTimestamp: null labels: appstudio.openshift.io/application: fedora-bootc-rawhide appstudio.openshift.io/component: fedora-bootc-rawhide-minimal-plus pipelines.appstudio.openshift.io/type: build name: fedora-bootc-rawhide-minimal-plus-on-pull-request + namespace: bootc-tenant spec: params: - name: git-url value: '{{source_url}}' - name: revision value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x + - name: output-image + value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal-plus:on-pr-{{revision}} + - name: image-expires-after + value: 5d - name: dockerfile value: Containerfile - name: path-context value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20261024.n.0@sha256:fbfdb547c10b4992539af9be0197985e189362e603fc96851f889f19e4c2e303 - - MANIFEST=fedora-minimal-plus - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal-plus:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=46 - pipelineRef: + pipelineSpec: + description: | + This pipeline is ideal for building container images from a Containerfile while maintaining trust after pipeline customization. + + _Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://enterprisecontract.dev/docs/ec-policies/release_policy.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. + This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_ + finally: + - name: show-sbom + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + taskRef: + params: + - name: name + value: show-sbom + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:945a7c9066d3e0a95d3fddb7e8a6992e4d632a2a75d8f3a9bd2ff2fef0ec9aa0 + - name: kind + value: task + resolver: bundles params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal-plus + - description: Source Repository URL + name: git-url + type: string + - default: "" + description: Revision of the Source Repository + name: revision + type: string + - description: Fully Qualified Output Image + name: output-image + type: string + - default: . + description: Path to the source code of an application's component from where + to build image. + name: path-context + type: string + - default: Dockerfile + description: Path to the Dockerfile inside the context specified by parameter + path-context + name: dockerfile + type: string + - default: "false" + description: Force rebuild image + name: rebuild + type: string + - default: "false" + description: Skip checks against built image + name: skip-checks + type: string + - default: "false" + description: Execute the build with network isolation + name: hermetic + type: string + - default: "" + description: Build dependencies to be prefetched by Cachi2 + name: prefetch-input + type: string + - default: "" + description: Image tag expiration time, time values could be something like + 1h, 2d, 3w for hours, days, and weeks, respectively. + name: image-expires-after + - default: "false" + description: Build a source image. + name: build-source-image + type: string + - default: "false" + description: Add built image into an OCI image index + name: build-image-index + type: string + - default: [] + description: Array of --build-arg values ("arg=value" strings) for buildah + name: build-args + type: array + - default: "" + description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file + name: build-args-file + type: string + results: + - description: "" + name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - description: "" + name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - description: "" + name: CHAINS-GIT_URL + value: $(tasks.clone-repository.results.url) + - description: "" + name: CHAINS-GIT_COMMIT + value: $(tasks.clone-repository.results.commit) + tasks: + - name: init + params: + - name: image-url + value: $(params.output-image) + - name: rebuild + value: $(params.rebuild) + - name: skip-checks + value: $(params.skip-checks) + taskRef: + params: + - name: name + value: init + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:63eb4a4c0cfb491276bff86fdad1c96bf238506388848e79001058450a8e843a + - name: kind + value: task + resolver: bundles + - name: clone-repository + params: + - name: url + value: $(params.git-url) + - name: revision + value: $(params.revision) + - name: ociStorage + value: $(params.output-image).git + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - init + taskRef: + params: + - name: name + value: git-clone-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:aab5f0f4906ba2c2a64a67b591c7ecf57018d066f1206ebc56158476e29f2cf3 + - name: kind + value: task + resolver: bundles + when: + - input: $(tasks.init.results.build) + operator: in + values: + - "true" + workspaces: + - name: basic-auth + workspace: git-auth + - name: prefetch-dependencies + params: + - name: input + value: $(params.prefetch-input) + - name: SOURCE_ARTIFACT + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + - name: ociStorage + value: $(params.output-image).prefetch + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - clone-repository + taskRef: + params: + - name: name + value: prefetch-dependencies-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.2@sha256:752230a646483aebd465a942aef4f35c08e67185609ac26e19a3b931de9b7b0a + - name: kind + value: task + resolver: bundles + workspaces: + - name: git-basic-auth + workspace: git-auth + - name: netrc + workspace: netrc + - name: build-container + params: + - name: IMAGE + value: $(params.output-image) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: HERMETIC + value: $(params.hermetic) + - name: PREFETCH_INPUT + value: $(params.prefetch-input) + - name: IMAGE_EXPIRES_AFTER + value: $(params.image-expires-after) + - name: COMMIT_SHA + value: $(tasks.clone-repository.results.commit) + - name: BUILD_ARGS + value: + - $(params.build-args[*]) + - name: BUILD_ARGS_FILE + value: $(params.build-args-file) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - prefetch-dependencies + taskRef: + params: + - name: name + value: buildah-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.4@sha256:161554446f481f89e35bfa6a87ec5f76154d678dd5fd33eaa16bd7eb4d1e8d37 + - name: kind + value: task + resolver: bundles + when: + - input: $(tasks.init.results.build) + operator: in + values: + - "true" + - name: build-image-index + params: + - name: IMAGE + value: $(params.output-image) + - name: COMMIT_SHA + value: $(tasks.clone-repository.results.commit) + - name: IMAGE_EXPIRES_AFTER + value: $(params.image-expires-after) + - name: ALWAYS_BUILD_INDEX + value: $(params.build-image-index) + - name: IMAGES + value: + - $(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST) + runAfter: + - build-container + taskRef: + params: + - name: name + value: build-image-index + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:0c2270d1b24fcbaa6fe82b6d045b715a5f24f55d099a10f65297671e2ee421e6 + - name: kind + value: task + resolver: bundles + when: + - input: $(tasks.init.results.build) + operator: in + values: + - "true" + - name: build-source-image + params: + - name: BINARY_IMAGE + value: $(params.output-image) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: source-build-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.2@sha256:183b28fc7c3ca8bc81b00d695517cd2e0b7c31e13365bcfd7e3c758ce13c489c + - name: kind + value: task + resolver: bundles + when: + - input: $(tasks.init.results.build) + operator: in + values: + - "true" + - input: $(params.build-source-image) + operator: in + values: + - "true" + - name: deprecated-base-image-check + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: deprecated-image-check + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:ced089bd8d86f95ee70f6ee1a6941d677f1c66c3b8f02fa60f9309c6c32e1929 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: clair-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clair-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.2@sha256:f636f2cbe91d9d4d9685a38c8bc680a36e17f568ec0e60a93da82d1284b488c5 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: ecosystem-cert-preflight-checks + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: ecosystem-cert-preflight-checks + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.1@sha256:df8a25a3431a70544172ed4844f9d0c6229d39130633960729f825a031a7dea9 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-snyk-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-snyk-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.3@sha256:ed777841052e05c61abc9fc66f6aad65f113bad719eeb2e04ce490fc175aaebe + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: clamav-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clamav-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.2@sha256:0db068e8a59612472a2483f5113893d0c5c9102e9ad7647d9a4789360e5bc2dc + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-coverity-check + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE + value: $(params.output-image) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: HERMETIC + value: $(params.hermetic) + - name: PREFETCH_INPUT + value: $(params.prefetch-input) + - name: IMAGE_EXPIRES_AFTER + value: $(params.image-expires-after) + - name: COMMIT_SHA + value: $(tasks.clone-repository.results.commit) + - name: BUILD_ARGS + value: + - $(params.build-args[*]) + - name: BUILD_ARGS_FILE + value: $(params.build-args-file) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - coverity-availability-check + taskRef: + params: + - name: name + value: sast-coverity-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.2@sha256:e92c350e3d115783b65b6bb06e548524d918c740c1929465f347d413d91d72ff + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - input: $(tasks.coverity-availability-check.results.STATUS) + operator: in + values: + - success + - name: coverity-availability-check + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: coverity-availability-check + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:91ba738df7ec548d4127163e07a88de06568a350fbf581405cc8fc8498f6153c + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-shell-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-shell-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:b00fa0294e6318ff8130ca11358ae0b3764c4e6c9a12ec7a953e1a813ca2e231 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-unicode-check + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-unicode-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.1@sha256:3a128580c41abdac5bd76d0d1e066f2f3473278ba9fab90639878a27ced7a0e6 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: apply-tags + params: + - name: IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: apply-tags + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.1@sha256:5e5f290359fd34ae4cc77cbbba6ef8c9907d752572d6dc2a00f5a4c504eb48bb + - name: kind + value: task + resolver: bundles + - name: push-dockerfile + params: + - name: IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: push-dockerfile-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:443e665458bd44f029c8e44e8d4c44e4faa8c533f129014ccb3c4c51fd89bbfc + - name: kind + value: task + resolver: bundles + - name: rpms-signature-scan + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: rpms-signature-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:b78123a326dc8378cb3fe0a3944c088726bfeb835694689fb4b8694b19448f02 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + workspaces: + - name: git-auth + optional: true + - name: netrc + optional: true + taskRunTemplate: {} + workspaces: + - name: git-auth + secret: + secretName: '{{ git_auth_secret }}' +status: {} diff --git a/.tekton/fedora-bootc-rawhide-minimal-plus-push.yaml b/.tekton/fedora-bootc-rawhide-minimal-plus-push.yaml index d626b405..2c6a98d6 100644 --- a/.tekton/fedora-bootc-rawhide-minimal-plus-push.yaml +++ b/.tekton/fedora-bootc-rawhide-minimal-plus-push.yaml @@ -7,63 +7,582 @@ metadata: build.appstudio.redhat.com/target_branch: '{{target_branch}}' pipelinesascode.tekton.dev/cancel-in-progress: "false" pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-rawhide-minimal-plus-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" + pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch + == "main" creationTimestamp: null labels: appstudio.openshift.io/application: fedora-bootc-rawhide appstudio.openshift.io/component: fedora-bootc-rawhide-minimal-plus pipelines.appstudio.openshift.io/type: build name: fedora-bootc-rawhide-minimal-plus-on-push + namespace: bootc-tenant spec: params: - name: git-url value: '{{source_url}}' - name: revision value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x + - name: output-image + value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal-plus:{{revision}} - name: dockerfile value: Containerfile - name: path-context value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20261024.n.0@sha256:fbfdb547c10b4992539af9be0197985e189362e603fc96851f889f19e4c2e303 - - MANIFEST=fedora-minimal-plus - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal-plus:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=46 - pipelineRef: + pipelineSpec: + description: | + This pipeline is ideal for building container images from a Containerfile while maintaining trust after pipeline customization. + + _Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://enterprisecontract.dev/docs/ec-policies/release_policy.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. + This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_ + finally: + - name: show-sbom + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + taskRef: + params: + - name: name + value: show-sbom + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:945a7c9066d3e0a95d3fddb7e8a6992e4d632a2a75d8f3a9bd2ff2fef0ec9aa0 + - name: kind + value: task + resolver: bundles params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal-plus + - description: Source Repository URL + name: git-url + type: string + - default: "" + description: Revision of the Source Repository + name: revision + type: string + - description: Fully Qualified Output Image + name: output-image + type: string + - default: . + description: Path to the source code of an application's component from where + to build image. + name: path-context + type: string + - default: Dockerfile + description: Path to the Dockerfile inside the context specified by parameter + path-context + name: dockerfile + type: string + - default: "false" + description: Force rebuild image + name: rebuild + type: string + - default: "false" + description: Skip checks against built image + name: skip-checks + type: string + - default: "false" + description: Execute the build with network isolation + name: hermetic + type: string + - default: "" + description: Build dependencies to be prefetched by Cachi2 + name: prefetch-input + type: string + - default: "" + description: Image tag expiration time, time values could be something like + 1h, 2d, 3w for hours, days, and weeks, respectively. + name: image-expires-after + - default: "false" + description: Build a source image. + name: build-source-image + type: string + - default: "false" + description: Add built image into an OCI image index + name: build-image-index + type: string + - default: [] + description: Array of --build-arg values ("arg=value" strings) for buildah + name: build-args + type: array + - default: "" + description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file + name: build-args-file + type: string + results: + - description: "" + name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - description: "" + name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - description: "" + name: CHAINS-GIT_URL + value: $(tasks.clone-repository.results.url) + - description: "" + name: CHAINS-GIT_COMMIT + value: $(tasks.clone-repository.results.commit) + tasks: + - name: init + params: + - name: image-url + value: $(params.output-image) + - name: rebuild + value: $(params.rebuild) + - name: skip-checks + value: $(params.skip-checks) + taskRef: + params: + - name: name + value: init + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:63eb4a4c0cfb491276bff86fdad1c96bf238506388848e79001058450a8e843a + - name: kind + value: task + resolver: bundles + - name: clone-repository + params: + - name: url + value: $(params.git-url) + - name: revision + value: $(params.revision) + - name: ociStorage + value: $(params.output-image).git + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - init + taskRef: + params: + - name: name + value: git-clone-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:aab5f0f4906ba2c2a64a67b591c7ecf57018d066f1206ebc56158476e29f2cf3 + - name: kind + value: task + resolver: bundles + when: + - input: $(tasks.init.results.build) + operator: in + values: + - "true" + workspaces: + - name: basic-auth + workspace: git-auth + - name: prefetch-dependencies + params: + - name: input + value: $(params.prefetch-input) + - name: SOURCE_ARTIFACT + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + - name: ociStorage + value: $(params.output-image).prefetch + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - clone-repository + taskRef: + params: + - name: name + value: prefetch-dependencies-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.2@sha256:752230a646483aebd465a942aef4f35c08e67185609ac26e19a3b931de9b7b0a + - name: kind + value: task + resolver: bundles + workspaces: + - name: git-basic-auth + workspace: git-auth + - name: netrc + workspace: netrc + - name: build-container + params: + - name: IMAGE + value: $(params.output-image) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: HERMETIC + value: $(params.hermetic) + - name: PREFETCH_INPUT + value: $(params.prefetch-input) + - name: IMAGE_EXPIRES_AFTER + value: $(params.image-expires-after) + - name: COMMIT_SHA + value: $(tasks.clone-repository.results.commit) + - name: BUILD_ARGS + value: + - $(params.build-args[*]) + - name: BUILD_ARGS_FILE + value: $(params.build-args-file) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - prefetch-dependencies + taskRef: + params: + - name: name + value: buildah-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.4@sha256:161554446f481f89e35bfa6a87ec5f76154d678dd5fd33eaa16bd7eb4d1e8d37 + - name: kind + value: task + resolver: bundles + when: + - input: $(tasks.init.results.build) + operator: in + values: + - "true" + - name: build-image-index + params: + - name: IMAGE + value: $(params.output-image) + - name: COMMIT_SHA + value: $(tasks.clone-repository.results.commit) + - name: IMAGE_EXPIRES_AFTER + value: $(params.image-expires-after) + - name: ALWAYS_BUILD_INDEX + value: $(params.build-image-index) + - name: IMAGES + value: + - $(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST) + runAfter: + - build-container + taskRef: + params: + - name: name + value: build-image-index + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:0c2270d1b24fcbaa6fe82b6d045b715a5f24f55d099a10f65297671e2ee421e6 + - name: kind + value: task + resolver: bundles + when: + - input: $(tasks.init.results.build) + operator: in + values: + - "true" + - name: build-source-image + params: + - name: BINARY_IMAGE + value: $(params.output-image) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: source-build-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.2@sha256:183b28fc7c3ca8bc81b00d695517cd2e0b7c31e13365bcfd7e3c758ce13c489c + - name: kind + value: task + resolver: bundles + when: + - input: $(tasks.init.results.build) + operator: in + values: + - "true" + - input: $(params.build-source-image) + operator: in + values: + - "true" + - name: deprecated-base-image-check + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: deprecated-image-check + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:ced089bd8d86f95ee70f6ee1a6941d677f1c66c3b8f02fa60f9309c6c32e1929 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: clair-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clair-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.2@sha256:f636f2cbe91d9d4d9685a38c8bc680a36e17f568ec0e60a93da82d1284b488c5 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: ecosystem-cert-preflight-checks + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: ecosystem-cert-preflight-checks + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.1@sha256:df8a25a3431a70544172ed4844f9d0c6229d39130633960729f825a031a7dea9 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-snyk-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-snyk-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.3@sha256:ed777841052e05c61abc9fc66f6aad65f113bad719eeb2e04ce490fc175aaebe + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: clamav-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clamav-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.2@sha256:0db068e8a59612472a2483f5113893d0c5c9102e9ad7647d9a4789360e5bc2dc + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-coverity-check + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE + value: $(params.output-image) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: HERMETIC + value: $(params.hermetic) + - name: PREFETCH_INPUT + value: $(params.prefetch-input) + - name: IMAGE_EXPIRES_AFTER + value: $(params.image-expires-after) + - name: COMMIT_SHA + value: $(tasks.clone-repository.results.commit) + - name: BUILD_ARGS + value: + - $(params.build-args[*]) + - name: BUILD_ARGS_FILE + value: $(params.build-args-file) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - coverity-availability-check + taskRef: + params: + - name: name + value: sast-coverity-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.2@sha256:e92c350e3d115783b65b6bb06e548524d918c740c1929465f347d413d91d72ff + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - input: $(tasks.coverity-availability-check.results.STATUS) + operator: in + values: + - success + - name: coverity-availability-check + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: coverity-availability-check + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:91ba738df7ec548d4127163e07a88de06568a350fbf581405cc8fc8498f6153c + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-shell-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-shell-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:b00fa0294e6318ff8130ca11358ae0b3764c4e6c9a12ec7a953e1a813ca2e231 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-unicode-check + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-unicode-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.1@sha256:3a128580c41abdac5bd76d0d1e066f2f3473278ba9fab90639878a27ced7a0e6 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: apply-tags + params: + - name: IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: apply-tags + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.1@sha256:5e5f290359fd34ae4cc77cbbba6ef8c9907d752572d6dc2a00f5a4c504eb48bb + - name: kind + value: task + resolver: bundles + - name: push-dockerfile + params: + - name: IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: push-dockerfile-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:443e665458bd44f029c8e44e8d4c44e4faa8c533f129014ccb3c4c51fd89bbfc + - name: kind + value: task + resolver: bundles + - name: rpms-signature-scan + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: rpms-signature-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:b78123a326dc8378cb3fe0a3944c088726bfeb835694689fb4b8694b19448f02 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + workspaces: + - name: git-auth + optional: true + - name: netrc + optional: true + taskRunTemplate: {} + workspaces: + - name: git-auth + secret: + secretName: '{{ git_auth_secret }}' +status: {} diff --git a/.tekton/fedora-bootc-rawhide-minimal-pull-request.yaml b/.tekton/fedora-bootc-rawhide-minimal-pull-request.yaml deleted file mode 100644 index 96804a5c..00000000 --- a/.tekton/fedora-bootc-rawhide-minimal-pull-request.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-rawhide-minimal-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-rawhide - appstudio.openshift.io/component: fedora-bootc-rawhide-minimal - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-rawhide-minimal-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20261024.n.0@sha256:fbfdb547c10b4992539af9be0197985e189362e603fc96851f889f19e4c2e303 - - MANIFEST=fedora-minimal - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=46 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal diff --git a/.tekton/fedora-bootc-rawhide-minimal-push.yaml b/.tekton/fedora-bootc-rawhide-minimal-push.yaml deleted file mode 100644 index 1214a828..00000000 --- a/.tekton/fedora-bootc-rawhide-minimal-push.yaml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-rawhide-minimal-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-rawhide - appstudio.openshift.io/component: fedora-bootc-rawhide-minimal - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-rawhide-minimal-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20261024.n.0@sha256:fbfdb547c10b4992539af9be0197985e189362e603fc96851f889f19e4c2e303 - - MANIFEST=fedora-minimal - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=46 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal diff --git a/.tekton/fedora-bootc-rawhide-standard-pull-request.yaml b/.tekton/fedora-bootc-rawhide-standard-pull-request.yaml deleted file mode 100644 index 5791bd3b..00000000 --- a/.tekton/fedora-bootc-rawhide-standard-pull-request.yaml +++ /dev/null @@ -1,74 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "true" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "pull_request" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-rawhide-standard-pull-request.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "standard.yaml".pathChanged() || - "standard/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-rawhide - appstudio.openshift.io/component: fedora-bootc-rawhide-standard - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-rawhide-standard-on-pull-request -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20261024.n.0@sha256:fbfdb547c10b4992539af9be0197985e189362e603fc96851f889f19e4c2e303 - - MANIFEST=fedora-standard - - name: image-expires-after - value: 5d - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-standard:on-pr-{{revision}} - - name: labels - value: - - org.opencontainers.image.version=46 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-rawhide-standard diff --git a/.tekton/fedora-bootc-rawhide-standard-push.yaml b/.tekton/fedora-bootc-rawhide-standard-push.yaml deleted file mode 100644 index d7f8f687..00000000 --- a/.tekton/fedora-bootc-rawhide-standard-push.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: tekton.dev/v1 -kind: PipelineRun -metadata: - annotations: - build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}} - build.appstudio.redhat.com/commit_sha: '{{revision}}' - build.appstudio.redhat.com/target_branch: '{{target_branch}}' - pipelinesascode.tekton.dev/cancel-in-progress: "false" - pipelinesascode.tekton.dev/max-keep-runs: "3" - pipelinesascode.tekton.dev/on-cel-expression: | - ( - (event == "push" && target_branch == "main") - ) && ( - ".tekton/fedora-bootc-rawhide-standard-push.yaml".pathChanged() || - "Containerfile".pathChanged() || - "bootc-base-imagectl".pathChanged() || - "install-manifests".pathChanged() || - "fedora-includes/generic.yaml".pathChanged() || - "minimal.yaml".pathChanged() || - "minimal/***".pathChanged() || - "minimal-plus.hidden.yaml".pathChanged() || - "minimal-plus/***".pathChanged() || - "standard.yaml".pathChanged() || - "standard/***".pathChanged() - ) - test.appstudio.openshift.io/comment_strategy: "disable_all" - creationTimestamp: null - labels: - appstudio.openshift.io/application: fedora-bootc-rawhide - appstudio.openshift.io/component: fedora-bootc-rawhide-standard - pipelines.appstudio.openshift.io/type: build - name: fedora-bootc-rawhide-standard-on-push -spec: - params: - - name: git-url - value: '{{source_url}}' - - name: revision - value: '{{revision}}' - - name: build-platforms - value: - - linux/amd64 - - linux/arm64 - - linux/s390x - - name: dockerfile - value: Containerfile - - name: path-context - value: . - - name: privileged-nested - value: true - - name: build-args - value: - - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20261024.n.0@sha256:fbfdb547c10b4992539af9be0197985e189362e603fc96851f889f19e4c2e303 - - MANIFEST=fedora-standard - - name: output-image - value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-standard:{{revision}} - - name: labels - value: - - org.opencontainers.image.version=46 - pipelineRef: - params: - - name: bundle - value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:29c2c03c8c3e8395a6392a0390c6e471ba71e79cf3f29dca150c502496aedd1a - - name: name - value: buildah-build-bootc-multi-platform-oci-ta - - name: kind - value: pipeline - resolver: bundles - timeouts: - pipeline: 6h - taskRunTemplate: - serviceAccountName: build-pipeline-fedora-bootc-rawhide-standard diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md deleted file mode 100644 index 1695c095..00000000 --- a/CONTRIBUTING.md +++ /dev/null @@ -1,37 +0,0 @@ -# Contributing to fedora-bootc base images - -## Prerequisites - -Everything revolves around our Containerfile, but there's -a high level wrapper in `Justfile` which you should use. -So installing `podman` (or `buildah`) and `just` are strongly recommended. - -## Building and testing - -Run `just --list` to see available targets and `just show-config` to -see current settings. The Justfile is also what CI invokes, so anything -you run locally is the same as what runs in the pipeline. - -Configuration is via environment variables — see the comments at the -top of the `Justfile` for the full list. For example: - -```bash -just build # defaults -TIER=minimal just build # different tier -FEDORA_VERSION=43 just test # different Fedora version -BUILDER=podman just build # use podman instead of buildah -just ci # full CI run (validate + test all tiers) -``` - -## Building a split image - -The Containerfile supports building a split (content-based layered) -image using [chunkah](https://github.com/coreos/chunkah) via the -`chunked` build target: - -```bash -just build --chunkah -``` - -Extra arguments can be passed to chunkah via the `CHUNKAH_ARGS` build -arg (e.g. `BUILDER_EXTRA='--build-arg CHUNKAH_ARGS="--max-layers 128"' just build --chunkah`). diff --git a/Containerfile b/Containerfile index 1aa03308..4bfaf006 100644 --- a/Containerfile +++ b/Containerfile @@ -2,46 +2,33 @@ # nested containerization, so you must build with e.g. # podman build --security-opt=label=disable --cap-add=all --device /dev/fuse <...> -# NOTE: This container build will output a single giant layer. You can either -# run the "rechunker" on the output of this build (see bootc-base-imagectl.md), -# or build the split version directly with `just build --chunkah` -# (or if using podman/buildah directly, add `--build-arg FINAL=chunked -# --skip-unused-stages=false -v $PWD:/run/src`). +# NOTE: This container build will output a single giant layer. It is strongly recommended +# to run the "rechunker" on the output of this build, see +# https://coreos.github.io/rpm-ostree/experimental-build-chunked-oci/ # Override this repos container to control the base image package versions. For # example, podman build --from=quay.io/fedora/fedora:41 will get you a system # that uses Fedora 41 packages. Or inject arbitrary yum repos (COPR, etc) here. -# -# Note we also support --build-arg REPOS_IMAGE=quay.io/fedora/fedora:41 here -# since konflux doesn't yet support --from. ARG REPOS_IMAGE=quay.io/fedora/fedora:rawhide -ARG BUILDER_IMAGE=quay.io/fedora/fedora:rawhide -# Either 'unchunked' or 'chunked'. Determines whether we take the chunkah path. -ARG FINAL=unchunked - FROM $REPOS_IMAGE as repos -# BOOTSTRAPPING: This can be any image that has rpm-ostree, selinux-policy-targeted -# and python3 (for bootc-base-imagectl). -FROM $BUILDER_IMAGE as builder -RUN dnf -y install rpm-ostree selinux-policy-targeted python3 + +# BOOTSTRAPPING: This can be any image that has rpm-ostree and selinux-policy-targeted. +FROM quay.io/fedora/fedora:41 as builder +# However we also pull rpm-ostree from git main to get some fixes for now +RUN </dev/null # Run the build script in the same way we expect custom images to do, and also # "re-inject" the manifests into the target, so secondary container builds can use it. -/usr/libexec/bootc-base-imagectl build-rootfs \ - --cachedir=/cache --reinject --manifest=${MANIFEST} /repos /target-rootfs +/usr/libexec/bootc-base-imagectl build-rootfs --reinject --manifest=${MANIFEST} /repos /target-rootfs EORUN # This pulls in the rootfs generated in the previous step -FROM scratch AS unchunked +FROM scratch COPY --from=builder /target-rootfs/ / - -FROM builder AS rechunker -RUN dnf -y install chunkah -ARG CHUNKAH_ARGS="" -RUN --mount=from=unchunked,src=/,target=/chunkah,ro \ - --mount=type=bind,target=/run/src,rw \ - /usr/libexec/bootc-base-imagectl rechunk --chunkah ${CHUNKAH_ARGS} \ - > /run/src/out.ociarchive -FROM oci-archive:out.ociarchive AS chunked - -FROM $FINAL +# Note in practice this won't be right in a cross build, so we don't +# set it here. This placeholder is just to note that it *should* be set +# by the larger build system (e.g. Konflux). +LABEL org.opencontainers.image.version 43 LABEL containers.bootc 1 # This is an ad-hoc way for us to reference bootc-image-builder in # a way that in theory client tooling can inspect and find. Today diff --git a/Justfile b/Justfile deleted file mode 100644 index eec0a0a2..00000000 --- a/Justfile +++ /dev/null @@ -1,91 +0,0 @@ -# Development entry point for fedora-bootc base images. -# Run `just --list` to see available targets. -# See CONTRIBUTING.md for more information. -# -------------------------------------------------------------------- - -# Content tier: standard (default), minimal, minimal-plus, iot -tier := env("TIER", "standard") -# Fedora version: rawhide (default), 43, 44, etc. -fedora_version := env("FEDORA_VERSION", "rawhide") -# Container build tool -builder := env("BUILDER", "buildah") -# Extra arguments for the builder -builder_extra := env("BUILDER_EXTRA", "") -# Output image name -image := "localhost/fedora-bootc" - -# These are required for the nested containerization used by rpm-ostree -# inside the Containerfile. -priv_args := "--security-opt=label=disable --cap-add=all --device /dev/fuse" - -# Internal -_build_cmd := builder + " build" -_tag := image + if tier == "standard" { "" } else { ":" + tier } -_base_image := "quay.io/fedora/fedora:" + fedora_version -_version_args := if fedora_version == "rawhide" { "" } else { "--build-arg=REPOS_IMAGE=" + _base_image + " --build-arg=BUILDER_IMAGE=" + _base_image } -_chunkah_args := "--build-arg FINAL=chunked --skip-unused-stages=false -v " + justfile_directory() + ":/run/src" - -# ============================================================================ -# Core targets -# ============================================================================ - -# Build the container image -[group('core')] -[arg("chunkah", long, value="true")] -build chunkah="": _check-tier - {{_build_cmd}} -f Containerfile --no-cache \ - -t {{_tag}} {{priv_args}} \ - {{_version_args}} {{builder_extra}} \ - {{if chunkah != "" { _chunkah_args } else { "" }}} \ - --build-arg=MANIFEST=fedora-{{tier}} . - -# Build and test -[group('core')] -test: build - #!/usr/bin/env bash - set -xeuo pipefail - {{_build_cmd}} -f tests/rootfs/Dockerfile -t localhost/test --from {{_tag}} tests/rootfs - # The derive and sysusers tests only apply to the standard tier - if [ "{{tier}}" = "standard" ]; then - {{_build_cmd}} -f tests/Containerfile.test-derive --no-cache \ - -t localhost/fedora-bootc-derived {{priv_args}} {{builder_extra}} tests - {{_build_cmd}} -f tests/Containerfile.test-sysusers --no-cache \ - -t localhost/fedora-bootc-derived {{priv_args}} {{builder_extra}} tests - fi - -# Run validation checks (whitespace, shellcheck, YAML) -[group('core')] -validate: - #!/usr/bin/env bash - set -xeuo pipefail - ./ci/find-whitespace - ./ci/shellcheck - ./ci/validate - -# Show current configuration -[group('core')] -show-config: - @echo "TIER={{tier}}" - @echo "FEDORA_VERSION={{fedora_version}}" - @echo "BUILDER={{builder}}" - @echo "image tag={{_tag}}" - @echo "base image={{_base_image}}" - -# ============================================================================ -# CI targets (used by .gitlab-ci.yml) -# ============================================================================ - -# Run all CI checks: validate + build and test all tiers -[group('ci')] -ci: validate - just tier=minimal test - just tier=minimal-plus test - just tier=standard test - -# ============================================================================ -# Internal -# ============================================================================ - -[private] -_check-tier: - @test -f fedora-{{tier}}.yaml || { echo "error: unknown tier '{{tier}}' (valid: standard, minimal, minimal-plus, iot)"; exit 1; } diff --git a/README.md b/README.md index 11a2fb3a..02b1e68b 100644 --- a/README.md +++ b/README.md @@ -14,53 +14,63 @@ delivery format for base operating system updates. The current default user experience is to build *layered* images on top of the official binary base images produced and tested by this project. See the documentation[5] for more info. -If you want total control over the image, you don't need to fork this repository. -Instead, you can use the existing container as a "builder" to make new images. -For more information, see the documentation[6]. +You can build custom base images by forking this repository; however, +https://gitlab.com/fedora/bootc/tracker/-/issues/32 tracks a more supportable +mechanism that is not simply forking. For more information see[6]. -## Contributing +## Build process -See [CONTRIBUTING.md](CONTRIBUTING.md) for the full development workflow. +Building the images in this repo can be done with `podman build`, but +note the build process uses a special podman-ecosystem specific mechanism +to create fully custom images while inside a `Containerfile`. +You need to enable some privileges as nested containerization is required. + +``` +podman build --security-opt=label=disable --cap-add=all \ + --device /dev/fuse -t localhost/fedora-bootc . +``` + +See the `Containerfile` for more details. This builds the default `standard` image. ## Fedora versions By default, the base images are built for Fedora rawhide. To build against a -different Fedora version: +different Fedora version, you can override the `FROM` image used to obtain the +Fedora repos and dnf variables. E.g.: -```bash -FEDORA_VERSION=43 just build +``` +podman build --from quay.io/fedora/fedora:41 ... ``` -## Content sets/tiers +### Deriving -Documentation above referenced the scratch[6] flow, -but there is also a `minimal-plus` that is not exposed as a stable -interface, but may be used by other images in Fedora. +You are of course also free to fork, customize, and build base images yourself. +See this page[6] of the documentation for more information. + +## Tiers + +At the current time, there is just one reference base image published +to the registry. Internally the content set is split up somewhat +into "tiers", but this is an internal implementation detail and may change +at any time. + +It is planned to rework and improve this in the future, especially +to support smaller custom images. For more on this, see +[this tracker issue](https://gitlab.com/fedora/bootc/tracker/-/issues/32). - **standard**: This image is the default, what is published as - + https://quay.io/repository/fedora/fedora-bootc - **minimal**: This content set is more of a convenient centralization point for CI - and curation around a package set that is intended as a starting point for + and curation around a package set that is intended as a starting point fror a container base image. - **minimal-plus**: This content set is intended to be the shared base used by all image-based Fedora variants (IoT, Atomic Desktops, and CoreOS). **standard** inherits from **minimal-plus** and **minimal-plus** in turn inherit from **minimal**. -- **eln** (manifest `fedora-eln`): Standard base image for Enterprise Linux Next (ELN). Uses distro `fedora` and inherits from standard; built with ELN repos. The image produced by this manifest is published as **fedora-eln**. - All non-trivial changes to **minimal** and **minimal-plus** should be ACKed by at least one stakeholder of each Fedora variant WGs. -### Available Tiers + Versions - -> **NOTE:** The location and naming of these images is subject to change. - -| Version | standard | minimal | minimal-plus | -| ------- | -------- | ------- | ------------ | -| Rawhide | quay.io/bootc-devel/fedora-bootc-rawhide-standard | quay.io/bootc-devel/fedora-bootc-rawhide-minimal | quay.io/bootc-devel/fedora-bootc-rawhide-minimal-plus | -| Fedora 43 | quay.io/bootc-devel/fedora-bootc-43-standard | quay.io/bootc-devel/fedora-bootc-43-minimal | quay.io/bootc-devel/fedora-bootc-43-minimal-plus | - ## More information Documentation: @@ -77,4 +87,4 @@ Documentation: [3]: https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit [4]: https://pre-commit.com/ [5]: https://docs.fedoraproject.org/en-US/bootc/building-containers/ -[6]: https://docs.fedoraproject.org/en-US/bootc/building-from-scratch/ +[6]: https://docs.fedoraproject.org/en-US/bootc/building-custom-base/ diff --git a/RELEASE.md b/RELEASE.md deleted file mode 100644 index fe2f6473..00000000 --- a/RELEASE.md +++ /dev/null @@ -1,306 +0,0 @@ -# Fedora Base Bootc Container Publishing - -## Overview - -The `fedora-base-bootc` image is published via **two parallel mechanisms**: - -1. **Pungi-IoT + cloud-image-uploader** → `quay.io/fedora/fedora-bootc` (Production) -2. **Konflux** → `quay.io/bootc-devel/fedora-bootc-*` (Development) - -The goal is to move to Konflux and deprecate the Pungi-IoT mechanism. - ---- - -## Part 1: Production Flow (Pungi-IoT) - -### Repositories - -| Repository | URL | Purpose | -|------------|-----|---------| -| base-images | https://pagure.io/fedora-iot/base-images | Image definition (treefiles, packages) | -| pungi-iot | https://pagure.io/fedora-iot/pungi-iot | Compose configuration | -| cloud-image-uploader | https://pagure.io/cloud-image-uploader | Uploads images to registries | -| ansible | https://pagure.io/fedora-infra/ansible | Infrastructure deployment | - -### Compose Cadence - -| Compose | Schedule | Host | -|---------|----------|------| -| IoT Rawhide | **Nightly** | compose-iot01.rdu3.fedoraproject.org | - -### Flow - -``` -┌──────────────────────────────────────────────────────────────────┐ -│ 1. IoT COMPOSE (compose-iot01.rdu3.fedoraproject.org) │ -│ Trigger: Daily cron │ -│ Script: pungi-iot/nightly.sh │ -│ Config: pungi-iot/fedora-iot.conf │ -│ Treefile: base-images/fedora-rawhide.yaml │ -│ │ -│ Output: /mnt/koji/compose/iot//compose/ │ -│ └── /images/Fedora-base-bootc-.ociarchive │ -└──────────────────────────────────────────────────────────────────┘ - │ - ▼ (fedora-messaging) -┌──────────────────────────────────────────────────────────────────┐ -│ 2. CLOUD-IMAGE-UPLOADER (OpenShift) │ -│ │ -│ Listens: org.fedoraproject.prod.pungi.compose.status.change │ -│ Maps: subvariant "base" → repository "fedora-bootc" │ -│ Pushes via skopeo to configured registries │ -└──────────────────────────────────────────────────────────────────┘ - │ - ▼ -┌──────────────────────────────────────────────────────────────────┐ -│ 3. CONTAINER REGISTRIES │ -│ │ -│ - quay.io/fedora/fedora-bootc │ -│ - registry.fedoraproject.org/fedora-bootc │ -└──────────────────────────────────────────────────────────────────┘ -``` - -### Key Configuration Files - -#### 1. Compose: Image Build Definition - -**File:** `pungi-iot/fedora-iot.conf` (lines 276-300) - -```python -ostree_container = { - "^IoT$": [ - { - "config_url": "https://pagure.io/fedora-iot/base-images", - "config_branch": "main", - "treefile": "fedora-rawhide.yaml", - "arches": ["x86_64", "aarch64", "ppc64le", "s390x"], - "subvariant": "base", # <-- Used for mapping - "name": "Fedora-base-bootc", - }, - ] -} -``` - -#### 2. Uploader: Subvariant to Repository Mapping - -**File:** `ansible/roles/openshift-apps/cloud-image-uploader/templates/config.toml` - -```toml -[consumer_config.container.repos] -base = "fedora-bootc" # subvariant "base" → repo "fedora-bootc" -IoT = "fedora-iot" -``` - -#### 3. Uploader: Target Registries - -**File:** `ansible/roles/openshift-apps/cloud-image-uploader/templates/config.toml` - -```toml -[[consumer_config.container.registries]] -url = "registry.fedoraproject.org" - -[[consumer_config.container.registries]] -url = "quay.io/fedora" -``` - -### Tags Applied - -| Compose Type | Tags | -|--------------|------| -| Rawhide | ``, `rawhide` | -| Current Stable | ``, `latest` | -| Branched | `` | - -### Common Changes (Production) - -| Task | Where to Change | -|------|-----------------| -| Add/remove packages from image | `base-images/` repo (manifest YAML files) | -| Change architectures | `pungi-iot/fedora-iot.conf` → `ostree_container.arches` | -| Add new registry | `ansible/.../cloud-image-uploader/templates/config.toml` → `registries` | -| Change repository name | `ansible/.../cloud-image-uploader/templates/config.toml` → `repos` mapping | -| Change tagging logic | `cloud-image-uploader/.../handler.py` | - ---- - -## Part 2: Development Flow (Konflux) - -### Repositories - -| Repository | URL | Purpose | -|------------|-----|---------| -| compose-images | https://gitlab.com/fedora/bootc/compose-images | Generates images containing RPMs used by base-images | -| base-images | https://gitlab.com/fedora/bootc/base-images | Image definitions + Tekton build pipelines | -| tekton-catalog | https://gitlab.com/fedora/bootc/tekton-catalog | Release pipeline definitions | -| tenants-config | https://gitlab.com/fedora/infrastructure/konflux/tenants-config | Konflux tenant configuration | - -### Flow - -``` -┌──────────────────────────────────────────────────────────────────────┐ -│ 0. COMPOSE IMAGES │ -│ │ -│ Source: gitlab.com/fedora/bootc/compose-images │ -│ Output: quay.io/bootc-devel/fedora-bootc--compose │ -│ │ -│ These images contain the RPM repositories used by base-images. │ -└──────────────────────────────────────────────────────────────────────┘ - │ - ▼ -┌──────────────────────────────────────────────────────────────────────┐ -│ 1. BUILD (triggered by git push or Renovate) │ -│ │ -│ Source: gitlab.com/fedora/bootc/base-images │ -│ Pipeline: .tekton/fedora-bootc-*-push.yaml │ -│ Input: REPOS_IMAGE from compose-images │ -│ │ -│ Output: quay.io/konflux-fedora/bootc-tenant/ │ -│ fedora-bootc--:{{revision}} │ -└──────────────────────────────────────────────────────────────────────┘ - │ - ▼ (Konflux creates Snapshot) -┌──────────────────────────────────────────────────────────────────────┐ -│ 2. RELEASE (auto-triggered by ReleasePlan) │ -│ │ -│ ReleasePlan: release-fedora-bootc-to-quay-io │ -│ Pipeline: push-to-external-registry │ -└──────────────────────────────────────────────────────────────────────┘ - │ - ▼ -┌──────────────────────────────────────────────────────────────────────┐ -│ 3. OUTPUT │ -│ │ -│ quay.io/bootc-devel/fedora-bootc--standard │ -│ quay.io/bootc-devel/fedora-bootc--minimal │ -│ quay.io/bootc-devel/fedora-bootc--minimal-plus │ -│ quay.io/bootc-devel/fedora-bootc--iot │ -└──────────────────────────────────────────────────────────────────────┘ -``` - -### Image Tiers - -See the [README](README.md) for details on the different image tiers (minimal, minimal-plus, standard, iot). - -### Renovate Automation - -Renovate automatically updates dependencies. See the description comments in [renovate.json](renovate.json) for scheduling and configuration details. - -### Common Changes (Development) - -| Task | Where to Change | -|------|-----------------| -| Add new component | `tenants-config/.../components/` | -| Change destination registry | `tenants-config/.../releaseplans/release-to-quay-io/` | -| Modify release pipeline | `tekton-catalog/pipelines/push-to-external-registry/` | -| Add new Fedora version | See [Adding a New Fedora Version](#adding-a-new-fedora-version-to-konflux) | -| Remove EOL Fedora version | See [Removing an EOL Fedora Version](#removing-an-eol-fedora-version-from-konflux) | - ---- - -## Part 3: Managing Fedora Versions in Konflux - -This section describes how to add a new Fedora version or remove an EOL version from Konflux. - -**Example scenario:** Fedora 42 is going EOL and needs to be removed. Rawhide (F45) is branching, so we need to add Fedora 44 as the new branched release. - -### Adding a New Fedora Version to Konflux - -#### Step 1: Add Release to compose-images Repo - -**Repository:** https://gitlab.com/fedora/bootc/compose-images - -Add the new release definition so that compose images are generated for the new version. This must be done first as base-images depends on these compose images. - -1. Create new Tekton pipelines in `.tekton/` for the new version (copy from existing version) -2. Update `RELEASEVER`, `COMPOSE_BRANCHED`, and labels in the new pipelines -3. Add a package rule for the new version in `renovate.json` - -See [MR !187](https://gitlab.com/fedora/bootc/compose-images/-/merge_requests/187) for reference (F44 addition). - -#### Step 2: Create Tekton Pipelines (base-images repo) - -**Repository:** https://gitlab.com/fedora/bootc/base-images - -Copy the current release pipelines to the new version and update rawhide for the next version. - -See the code snippets used for F44 in [MR !363 comment](https://gitlab.com/fedora/bootc/base-images/-/merge_requests/363#note_3071603283) for reference. - -#### Step 3: Update Renovate Configuration (base-images repo) - -Add package rules for the new version in `renovate.json`. See the existing rules for other versions as a template. - -#### Step 4: Create Tenant Configuration (tenants-config repo) - -**Repository:** https://gitlab.com/fedora/infrastructure/konflux/tenants-config - -```bash -cd clusters/kflux-fedora-01/tenants/bootc-tenant/applications/fedora-bootc/ -NEW_RELEASE=44 - -# Copy from rawhide -cp -r rawhide $NEW_RELEASE - -# Update version references -sed -i "s/compose-rawhide-id/compose-branched-id/" $NEW_RELEASE/releaseplans/release-to-quay-io/kustomization.yaml -find "${NEW_RELEASE}/" -type f | xargs sed -i "s/rawhide/$NEW_RELEASE/g" -``` - - -Add the new version to `fedora-bootc/kustomization.yaml`: - -```yaml -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - "rawhide" - - "44" # <-- Add new version - - "43" - - "42" -``` - -See [MR !237](https://gitlab.com/fedora/infrastructure/konflux/tenants-config/-/merge_requests/237) for reference (F45 addition). - -### Removing an EOL Fedora Version from Konflux - -When a Fedora version reaches EOL (e.g., F42), follow these steps: - -#### Step 1: Remove Tekton Pipelines (base-images repo) - -**Repository:** https://gitlab.com/fedora/bootc/base-images - -```bash -cd .tekton/ -git rm fedora-bootc-42-*.yaml -``` - -#### Step 2: Remove Renovate Rules (base-images repo) - -Remove the package rules for F42 from `renovate.json` (the two blocks matching `fedora-bootc-42-*`). - -#### Step 3: Remove Tenant Configuration (tenants-config repo) - -**Repository:** https://gitlab.com/fedora/infrastructure/konflux/tenants-config - -Remove the version from `fedora-bootc/kustomization.yaml` and delete the directory: - -```bash -cd cluster/kfluxfedorap01/bootc-tenant/applications/fedora-bootc/ - -# Edit kustomization.yaml to remove "42" from resources - -# Delete the version directory -rm -rf 42/ -``` - -#### Step 4: Remove from compose-images Repo - -**Repository:** https://gitlab.com/fedora/bootc/compose-images - -Remove the EOL release pipelines and renovate rules: - -```bash -cd .tekton/ -git rm fedora-bootc-42-compose-*.yaml -``` - -Also remove the package rule for F42 from `renovate.json` (the block matching `fedora-42-.*-compose`). diff --git a/bootc-base-imagectl b/bootc-base-imagectl index 3064986c..80d53079 100755 --- a/bootc-base-imagectl +++ b/bootc-base-imagectl @@ -1,17 +1,14 @@ #!/usr/bin/env python3 -import argparse -import json import os import os.path as path -import shlex +import subprocess import shutil import stat -import subprocess +import json +import argparse import sys -import tempfile -ARCH = os.uname().machine MANIFESTDIR = 'usr/share/doc/bootc-base-imagectl/manifests' def run_build_rootfs(args): @@ -19,90 +16,19 @@ def run_build_rootfs(args): Regenerates a base image using a build configuration. """ target = args.target - for fn in [f'{args.manifest}.yaml', f'{args.manifest}.hidden.yaml']: - manifest_path = f'/{MANIFESTDIR}/{fn}' - if os.path.exists(manifest_path): - break + if os.path.isdir(args.manifest): + manifest_path = os.path.join(args.manifest, 'manifest.yaml') else: - raise Exception(f"manifest not found: {args.manifest}") - - # A fix for https://issues.redhat.com/browse/RHEL-108989 - subprocess.check_call(['dnf', 'repolist'], stdout=subprocess.DEVNULL) - - rpmostree_argv = ['rpm-ostree', 'compose', 'rootfs'] - - override_manifest = {} - tmp_ostree_repo = None - if args.install: - additional_pkgs = [shlex.quote(p) for p in set(args.install)] - if len(additional_pkgs) > 0: - override_manifest['packages'] = list(additional_pkgs) - if args.exclude: - exclude_pkgs = [shlex.quote(p) for p in set(args.exclude)] - if len(exclude_pkgs) > 0: - override_manifest['exclude-packages'] = list(exclude_pkgs) - if args.add_dir: - tmp_ostree_repo = tempfile.mkdtemp(dir='/var/tmp') - subprocess.check_call(['ostree', 'init', '--repo', tmp_ostree_repo, '--mode=bare']) - rpmostree_argv.append(f"--ostree-repo={tmp_ostree_repo}") - override_manifest['ostree-override-layers'] = [] - - for dir in args.add_dir: - print(f"Processing --add-dir for {dir}") - base = os.path.basename(dir) - abs = os.path.realpath(dir) - if not os.path.exists(abs): - raise Exception(f"add dir directory not found: {abs}") - # capture output to hide commit digest printed - subprocess.check_output(['ostree', 'commit', '--repo', tmp_ostree_repo, '-b', f'overlay/{base}', abs, - '--owner-uid=0', '--owner-gid=0', '--no-xattrs', '--mode-ro-executables']) - override_manifest['ostree-override-layers'].append(f'overlay/{base}') - if args.no_docs: - override_manifest['documentation'] = False - if args.recommends: - override_manifest['recommends'] = True - if args.no_initramfs: - override_manifest['no-initramfs'] = True - if args.sysusers: - override_manifest['sysusers'] = 'compose-forced' - passwd_mode = 'nobody' if args.nobody_99 else 'none' - override_manifest['variables'] = {'passwd_mode': passwd_mode} - if args.repo: - override_manifest['repos'] = args.repo - - tmp_manifest = None - if override_manifest: - override_manifest['include'] = manifest_path - tmp_manifest = tempfile.NamedTemporaryFile(mode='w', encoding='utf-8', suffix='.json', delete=False) - json.dump(override_manifest, tmp_manifest) - tmp_manifest.close() - manifest_path = tmp_manifest.name - - tmp_lockfile = None - if args.lock: - lockfile = {'packages': {}} - for nevra in args.lock: - # we support passing either a NEVRA or a NEVR - name, ev, r_or_ra = nevra.rsplit('-', 2) - evr_or_evra = f'{ev}-{r_or_ra}' - field = 'evra' if r_or_ra.endswith(('.noarch', f'.{ARCH}')) else 'evr' - lockfile['packages'][name] = {field: evr_or_evra} - - tmp_lockfile = tempfile.NamedTemporaryFile(mode='w', encoding='utf-8', suffix='.json', delete=False) - json.dump(lockfile, tmp_lockfile) - tmp_lockfile.close() - rpmostree_argv.append(f"--lockfile={tmp_lockfile.name}") - + manifest_path = args.manifest + '.yaml' + rpmostree_argv = ['rpm-ostree', 'experimental', 'compose', 'rootfs'] try: - if args.cachedir != "": - rpmostree_argv.append(f"--cachedir={args.cachedir}") # Assume we can mutate alternative roots if args.source_root != '/': rpmostree_argv.append(f'--source-root-rw={args.source_root}') else: # But we shouldn't need to mutate the default root rpmostree_argv.append('--source-root=/') - rpmostree_argv.extend([manifest_path, target]) + rpmostree_argv.extend([f'/{MANIFESTDIR}/{manifest_path}', target]) # Perform the build subprocess.run(rpmostree_argv, check=True) # Work around https://github.com/coreos/rpm-ostree/pull/5322 @@ -120,13 +46,6 @@ def run_build_rootfs(args): except subprocess.CalledProcessError as e: print(f"Error executing command: {e}") sys.exit(1) - finally: - if tmp_lockfile is not None: - os.unlink(tmp_lockfile.name) - if tmp_manifest is not None: - os.unlink(tmp_manifest.name) - if tmp_ostree_repo: - shutil.rmtree(tmp_ostree_repo) # Copy our own build configuration into the target if configured; # this is used for the first stage build. But by default *secondary* @@ -142,46 +61,28 @@ def run_build_rootfs(args): shutil.copy('/' + f, dst) def run_rechunk(args): - if args.chunkah: - argv = ['chunkah', 'build', '--rootfs=/chunkah'] - if args.max_layers is not None: - argv.append(f"--max-layers={args.max_layers}") - # Strip OSTree data and labels for bootc compatibility; see - # https://github.com/coreos/chunkah#compatibility-with-bootable-bootc-images - argv.extend(['--prune', '/sysroot/', - '--label', 'ostree.commit-', - '--label', 'ostree.final-diffid-']) - try: - subprocess.run(argv, check=True) - except subprocess.CalledProcessError as e: - print(f"Error executing command: {e}", file=sys.stderr) - sys.exit(1) - else: - if not args.from_image or not args.to_image: - print("Error: from_image and to_image are required when not using --chunkah", file=sys.stderr) - sys.exit(1) - argv = [ - 'rpm-ostree', - 'experimental', - 'compose', - 'build-chunked-oci'] - if args.max_layers is not None: - argv.append(f"--max-layers={args.max_layers}") - argv.extend(['--bootc', - '--format-version=1', - f'--from={args.from_image}', - f'--output=containers-storage:{args.to_image}']) - try: - subprocess.run(argv, check=True) - except subprocess.CalledProcessError as e: - print(f"Error executing command: {e}") - sys.exit(1) + argv = [ + 'rpm-ostree', + 'experimental', + 'compose', + 'build-chunked-oci'] + if args.max_layers is not None: + argv.append(f"--max-layers={args.max_layers}") + argv.extend(['--bootc', + '--format-version=1', + f'--from={args.from_image}', + f'--output=containers-storage:{args.to_image}']) + try: + subprocess.run(argv, check=True) + except subprocess.CalledProcessError as e: + print(f"Error executing command: {e}") + sys.exit(1) def run_list(args): d = '/' + MANIFESTDIR for ent in sorted(os.listdir(d)): name, ext = os.path.splitext(ent) - if ext != '.yaml' or name.endswith('.hidden'): + if ext != '.yaml': continue fullpath = os.path.join(d, ent) if os.path.islink(fullpath): @@ -194,44 +95,23 @@ def run_list(args): if __name__ == "__main__": parser = argparse.ArgumentParser(description="Operate on the build configuration for this container") - parser.add_argument("--args-file", help="File containing arguments to parse (one argument per line)", metavar='FILE') subparsers = parser.add_subparsers(help='Subcommands', required=True) build_rootfs = subparsers.add_parser('build-rootfs', help='Generate a container root filesystem') build_rootfs.add_argument("--reinject", help="Also reinject the build configurations into the target", action='store_true') build_rootfs.add_argument("--manifest", help="Use the specified manifest", action='store', default='default') - build_rootfs.add_argument("--install", help="Add a package", action='append', default=[], metavar='PACKAGE') - build_rootfs.add_argument("--exclude", help="Exclude a package", action='append', default=[], metavar='PACKAGE') - build_rootfs.add_argument("--cachedir", help="Cache repo metadata and RPMs in specified directory", action='store', default='') - build_rootfs.add_argument("--add-dir", help='Copy dir contents into the target', action='append', default=[], metavar='DIR') - build_rootfs.add_argument("--no-docs", help="Don't install documentation", action='store_true') - build_rootfs.add_argument("--recommends", help="Whether to install recommended packages", action='store_true') - build_rootfs.add_argument("--no-initramfs", help="Whether to generate an initramfs for the roots", action='store_true') - build_rootfs.add_argument("--sysusers", help="Run systemd-sysusers instead of injecting hardcoded passwd/group entries", action='store_true') - build_rootfs.add_argument("--nobody-99", help=argparse.SUPPRESS, action='store_true') - build_rootfs.add_argument("--repo", help="Enable specific repositories only", action='append', default=[], metavar='REPO') - build_rootfs.add_argument("--lock", help="Lock package to specific version; can be NEVRA or NEVR", action='append', default=[], metavar='NEVRA') build_rootfs.add_argument("source_root", help="Path to the source root directory used for dnf configuration (default=/)", nargs='?', default='/') build_rootfs.add_argument("target", help="Path to the target root directory that will be generated.") build_rootfs.set_defaults(func=run_build_rootfs) cmd_rechunk = subparsers.add_parser('rechunk', help="Generate a new container image with split, reproducible, chunked layers") - cmd_rechunk.add_argument("--chunkah", help="Use chunkah instead of rpm-ostree (reads rootfs from /chunkah, writes OCI archive to stdout)", action='store_true') cmd_rechunk.add_argument("--max-layers", help="Configure the number of output layers") - cmd_rechunk.add_argument("from_image", help="Operate on this image in the container storage", nargs='?') - cmd_rechunk.add_argument("to_image", help="Output a new image to the container storage", nargs='?') + cmd_rechunk.add_argument("from_image", help="Operate on this image in the container storage") + cmd_rechunk.add_argument("to_image", help="Output a new image to the container storage") cmd_rechunk.set_defaults(func=run_rechunk) cmd_list = subparsers.add_parser('list', help='List available manifests') cmd_list.set_defaults(func=run_list) args = parser.parse_args() - if args.args_file: - add_args = [] - with open(args.args_file) as f: - for line in f: - add_args += [line.strip()] - args = parser.parse_args(sys.argv[1:] + add_args) - - args.func(args) - + args.func(args) \ No newline at end of file diff --git a/bootc-base-imagectl.md b/bootc-base-imagectl.md index b98d01ca..b3cba04a 100644 --- a/bootc-base-imagectl.md +++ b/bootc-base-imagectl.md @@ -47,15 +47,6 @@ This command takes just two arguments: - A path to the target root filesystem which will be generated as a directory. The target should not already exist (but its parent must exist). -### Implementation - -The current implementation uses `rpm-ostree` on a manifest (treefile) -embedded in the container image itself. These manifests are not intended -to be editable directly. - -To emphasize: the implementation of this command (especially the configuration -files that it reads) are subject to change. - ## Using bootc-base-imagectl rechunk This operation is strongly related to `build-rootfs` but is also orthogonal; @@ -99,40 +90,11 @@ and downloaded by clients, even if the content didn't actually change. The `bootc-base-imagectl rechunk` command fixes all of these issues by taking an input container, operates on its final merged filesystem tree (hence removed/overridden files are handled), and then splits it up -(currently based on the RPM database) into separate layers (tarballs). +(currently based on the RPM database) into separate layers (tarballs). Further, because bootc uses OSTree today, and OSTree canonializes all timestamps to zero on the client side, this tool does that at build time. -### Using chunkah instead of rpm-ostree - -The `--chunkah` flag switches rechunk to use [chunkah] instead of -rpm-ostree for layer splitting. In this mode, chunkah reads the rootfs -from `/chunkah` (its default) and writes an OCI archive to stdout. -The `from_image` and `to_image` positional arguments are not used. -The `--max-layers` option is respected and passed through to chunkah. - -This mode automatically passes `--prune /sysroot/` to strip OSTree data -and `--label ostree.commit-` / `--label ostree.final-diffid-` to remove -OSTree-specific labels. In other words, this produces plain OCI bootc images -without any OSTree content. - -To rechunk an existing image using chunkah: - -``` -IMG=quay.io/exampleos/exampleos:latest -podman run --rm --mount=type=image,src=$IMG,dest=/chunkah \ - -e CHUNKAH_CONFIG_STR="$(podman inspect $IMG)" \ - quay.io/fedora/fedora-bootc:rawhide \ - /usr/libexec/bootc-base-imagectl rechunk --chunkah | podman load -``` - -The `CHUNKAH_CONFIG_STR` environment variable passes the original -image's metadata (labels, environment, command, etc.) to chunkah so -that it is retained in the rechunked output. - -[chunkah]: https://github.com/coreos/chunkah - ### Other options `bootc-base-imagectl list` will enumerate available configurations that @@ -140,15 +102,18 @@ can be selected by passing `--manifest` to `build-rootfs`. ### Implementation -The default rechunking implementation also uses `rpm-ostree`. The `--chunkah` -mode uses [chunkah] instead, which is content-agnostic and not tied to -rpm-ostree. +The current implementation uses `rpm-ostree` on a manifest (treefile) +embedded in the container image itself. These manifests are not intended +to be editable directly. + +To emphasize: the implementation of this command (especially the configuration +files that it reads) are subject to change. ### Cross builds and the builder image The build tooling is designed to support "cross builds"; the repository root could e.g. be CentOS Stream 10, while the -builder root is Fedora or RHEL, etc. +builder root is Fedora or RHEL, etc. In other words, one given base image can be used as a "builder" to produce another using different RPMs. diff --git a/ci/find-whitespace b/ci/find-whitespace deleted file mode 100755 index d72b9b7e..00000000 --- a/ci/find-whitespace +++ /dev/null @@ -1,65 +0,0 @@ -#!/bin/bash - -set -euo pipefail - -main() { - - local files_with_whitespace="" - local files_with_missing_empty_line_at_eof="" - - while IFS= read -r -d '' f; do - echo "[+] Checking ${f}" - - # Looking for whitespace at end of line - if grep -Eq " +$" "${f}"; then - # List of files to ignore - if \ - [[ "${f}" == "./live/isolinux/boot.msg" ]] \ - ; then - echo "[+] Checking ${f}: Ignoring whitespace at end of line" - else - echo "[+] Checking ${f}: Found whitespace at end of line" - files_with_whitespace+=" ${f}" - fi - fi - - # Looking for missing empty line at end of file - if [[ -n $(tail -c 1 "${f}") ]]; then - # List of files to ignore - if \ - [[ "${f}" == "./tests/kola/ignition/resource/authenticated-gs/data/expected/"* ]] ||\ - [[ "${f}" == "./tests/kola/ignition/resource/authenticated-s3/data/expected/"* ]] ||\ - [[ "${f}" == "./tests/kola/ignition/resource/remote/data/expected/"* ]] \ - ; then - echo "[+] Checking ${f}: Ignoring missing empty line at end of file" - else - echo "[+] Checking ${f}: Missing empty line at end of file" - files_with_missing_empty_line_at_eof+=" ${f}" - fi - fi - done< <(find . -path "./.git" -prune -o -type f -print0) - - echo "" - if [[ -n "${files_with_whitespace}" ]]; then - echo "[+] Found files with whitespace at the end of line" - echo "${files_with_whitespace}" | tr ' ' '\n' - else - echo "[+] No files with whitespace at the end of line" - fi - - echo "" - if [[ -n "${files_with_missing_empty_line_at_eof}" ]]; then - echo "[+] Found files with missing empty line at end of file" - echo "${files_with_missing_empty_line_at_eof}" | tr ' ' '\n' - else - echo "[+] No files with missing empty line at end of file" - fi - - if [[ -n "${files_with_whitespace}" ]] || [[ -n "${files_with_missing_empty_line_at_eof}" ]]; then - exit 1 - fi - - exit 0 -} - -main "${@}" diff --git a/ci/shellcheck b/ci/shellcheck deleted file mode 100755 index 7543bd38..00000000 --- a/ci/shellcheck +++ /dev/null @@ -1,35 +0,0 @@ -#!/bin/bash -# Template generated by https://github.com/coreos/repo-templates; do not edit downstream - -set -euo pipefail - -main() { - local found_errors="false" - # Let's start with error, then we can do warning, info, style - local -r severity="error" - - while IFS= read -r -d '' f; do - # Skip non-text files that are very unlikely to be shell scripts - if [[ "$(file -b --mime-type "${f}" | sed 's|/.*||')" != "text" ]]; then - continue - fi - shebang="$(head -1 "${f}")" - if [[ "${f}" == *.sh ]] || \ - [[ ${shebang} =~ ^#!/.*/bash.* ]] || \ - [[ ${shebang} =~ ^#!/.*/env\ bash ]]; then - echo "[+] Checking ${f}" - shellcheck --external-sources --shell bash --severity="${severity}" "${f}" || found_errors="true" - bash -n "${f}" || found_errors="true" - fi - done< <(find . -path "./.git" -prune -o -path "./vendor" -prune -o -type f -print0) - - if [[ "${found_errors}" != "false" ]]; then - echo "[+] Found errors with ShellCheck" - exit 1 - fi - - echo "[+] No error found with ShellCheck" - exit 0 -} - -main "${@}" diff --git a/ci/validate b/ci/validate deleted file mode 100755 index dd36077c..00000000 --- a/ci/validate +++ /dev/null @@ -1,71 +0,0 @@ -#!/usr/bin/python3 -# Validate basic syntax of shell script and yaml. - -import os -import re -import stat -import subprocess -import yaml - -INITRD_SERVICES_WITHOUT_BEFORE = { - # Depended on by other services - 'coreos-livepxe-rootfs.service', -} - -validated=0 - -def openat(dirfd, name, mode='r'): - def opener(path, flags): - return os.open(path, flags, dir_fd=dirfd) - return open(name, mode, opener=opener) - - -def validate_initrd_service(rootfd, name): - with openat(rootfd, name) as fh: - if ([l for l in fh.readlines() if l.startswith('Before=')] or - name in INITRD_SERVICES_WITHOUT_BEFORE): - global validated - validated += 1 - else: - raise Exception( - f'{name} has no Before= and may race with switch-root' - ) - - -BASH_UNBRACKETED_IF = re.compile(r'\sif\s+"?\$') -def validate_shell(rootfd, name): - subprocess.check_call(['bash', '-n', name], preexec_fn=lambda: os.fchdir(rootfd)) - with openat(rootfd, name) as fh: - if BASH_UNBRACKETED_IF.search(fh.read()): - raise Exception(f'Possible unbracketed conditional in {name}') - global validated - validated +=1 - - -for root, dirs, files, rootfd in os.fwalk('.'): - # Skip .git - if '.git' in dirs: - dirs.remove('.git') - for name in files: - print(f"[+] Looking at {name}") - if name.endswith(('.yaml', '.yml')): - with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f: - yaml.safe_load(f) - validated +=1 - continue - elif name.endswith('.sh'): - validate_shell(rootfd, name) - continue - elif 'dracut/modules.d' in root and name.endswith('.service'): - validate_initrd_service(rootfd, name) - stbuf = os.lstat(name, dir_fd=rootfd) - if not stat.S_ISREG(stbuf.st_mode): - continue - if not stbuf.st_mode & stat.S_IXUSR: - continue - mimetype = subprocess.check_output(['file', '-b', '--mime-type', name], encoding='UTF-8', - preexec_fn=lambda: os.fchdir(rootfd)).strip() - if mimetype == 'text/x-shellscript': - validate_shell(rootfd, name) - -print(f"Validated {validated} files") diff --git a/eln.yaml b/eln.yaml deleted file mode 120000 index d35d04cd..00000000 --- a/eln.yaml +++ /dev/null @@ -1 +0,0 @@ -fedora-eln.yaml \ No newline at end of file diff --git a/eln/20-rhel.toml b/eln/20-rhel.toml deleted file mode 100644 index 32a278d1..00000000 --- a/eln/20-rhel.toml +++ /dev/null @@ -1,2 +0,0 @@ -[install] -root-fs-type = "xfs" diff --git a/eln/bootc-install.yaml b/eln/bootc-install.yaml deleted file mode 100644 index 59420d8e..00000000 --- a/eln/bootc-install.yaml +++ /dev/null @@ -1,3 +0,0 @@ -add-files: - - - 20-rhel.toml - - /usr/lib/bootc/install/20-rhel.toml diff --git a/eln/manifest.yaml b/eln/manifest.yaml deleted file mode 100644 index a18488c6..00000000 --- a/eln/manifest.yaml +++ /dev/null @@ -1,9 +0,0 @@ -metadata: - summary: | - Standard bootc base image for Enterprise Linux Next (ELN). - This manifest is the source for the image published as fedora-eln. - ELN is the Fedora package set (rawhide sources, ELN buildroot/compose). - -include: - - ../standard/manifest.yaml - - bootc-install.yaml diff --git a/fedora-43.yaml b/fedora-40.yaml similarity index 92% rename from fedora-43.yaml rename to fedora-40.yaml index a3cdc33a..647be5ad 100644 --- a/fedora-43.yaml +++ b/fedora-40.yaml @@ -1,6 +1,6 @@ # NB: This treefile is used by the legacy pungi path only to build tier-1. It # will be removed in the future. -releasever: 43 +releasever: 40 repos: - fedora - fedora-updates diff --git a/fedora-45.yaml b/fedora-42.yaml similarity index 91% rename from fedora-45.yaml rename to fedora-42.yaml index 9c86c402..26fed962 100644 --- a/fedora-45.yaml +++ b/fedora-42.yaml @@ -1,6 +1,6 @@ # NB: This treefile is used by the legacy pungi path only to build tier-1. It # will be removed in the future. -releasever: 45 +releasever: 42 repos: - fedora-devel include: fedora-bootc.yaml diff --git a/fedora-44.yaml b/fedora-44.yaml deleted file mode 100644 index 912f7eae..00000000 --- a/fedora-44.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# NB: This treefile is used by the legacy pungi path only to build tier-1. It -# will be removed in the future. -releasever: 44 -repos: - - fedora - - fedora-updates -include: fedora-bootc.yaml diff --git a/fedora-eln.yaml b/fedora-eln.yaml deleted file mode 100644 index 12e224b2..00000000 --- a/fedora-eln.yaml +++ /dev/null @@ -1,6 +0,0 @@ -repos: - - eln-baseos - - eln-appstream -include: - - fedora-includes/eln.yaml - - eln/manifest.yaml diff --git a/fedora-includes/eln.yaml b/fedora-includes/eln.yaml deleted file mode 100644 index 4b1bcf46..00000000 --- a/fedora-includes/eln.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# ELN uses the same distro variable as Fedora: ELN is a compose of Fedora -# Rawhide sources (see docs.fedoraproject.org/en-US/eln/). Repos come from -# REPOS_IMAGE at build time; we do not add fedora-repos-archive here. -variables: - distro: "fedora" - -packages: [] diff --git a/fedora-iot.yaml b/fedora-iot.yaml deleted file mode 120000 index 015e6542..00000000 --- a/fedora-iot.yaml +++ /dev/null @@ -1 +0,0 @@ -iot.yaml \ No newline at end of file diff --git a/fedora-minimal-plus.yaml b/fedora-minimal-plus.yaml deleted file mode 120000 index a1f9a23f..00000000 --- a/fedora-minimal-plus.yaml +++ /dev/null @@ -1 +0,0 @@ -minimal-plus.hidden.yaml \ No newline at end of file diff --git a/fedora-minimal-plus.yaml b/fedora-minimal-plus.yaml new file mode 100644 index 00000000..a987b388 --- /dev/null +++ b/fedora-minimal-plus.yaml @@ -0,0 +1,3 @@ +include: + - fedora-includes/generic.yaml + - minimal-plus/manifest.yaml diff --git a/fedora-minimal.yaml b/fedora-minimal.yaml deleted file mode 120000 index 57d7672a..00000000 --- a/fedora-minimal.yaml +++ /dev/null @@ -1 +0,0 @@ -minimal.yaml \ No newline at end of file diff --git a/fedora-minimal.yaml b/fedora-minimal.yaml new file mode 100644 index 00000000..a6b3b236 --- /dev/null +++ b/fedora-minimal.yaml @@ -0,0 +1,3 @@ +include: + - fedora-includes/generic.yaml + - minimal/manifest.yaml diff --git a/fedora-standard.yaml b/fedora-standard.yaml deleted file mode 120000 index 55bfa44e..00000000 --- a/fedora-standard.yaml +++ /dev/null @@ -1 +0,0 @@ -standard.yaml \ No newline at end of file diff --git a/fedora-standard.yaml b/fedora-standard.yaml new file mode 100644 index 00000000..73eeb5dc --- /dev/null +++ b/fedora-standard.yaml @@ -0,0 +1,3 @@ +include: + - fedora-includes/generic.yaml + - standard/manifest.yaml diff --git a/finalize.d/01-pungi-install-manifests.sh b/finalize.d/01-pungi-install-manifests.sh deleted file mode 100755 index 8a290fe3..00000000 --- a/finalize.d/01-pungi-install-manifests.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -set -xeuo pipefail - -# This is used in the legacy Pungi path. It won't get run in the -# container-native path since install-manifests doesn't copy this script itself -# into usr/share/doc. -target_rootfs=$(pwd) -cd "$RPMOSTREE_WORKDIR" -./install-manifests "$target_rootfs"/usr/share/doc/bootc-base-imagectl/manifests -install -m 0755 -t "$target_rootfs"/usr/libexec bootc-base-imagectl diff --git a/install-manifests b/install-manifests index 89c1b3bd..867eb623 100755 --- a/install-manifests +++ b/install-manifests @@ -4,24 +4,12 @@ set -xeuo pipefail # into their installed location. manifestdir=${1:-/usr/share/doc/bootc-base-imagectl/manifests} mkdir -p "$manifestdir/" -for image in minimal standard minimal-plus iot; do +for image in minimal standard minimal-plus; do # Embed the generic defaults cp -a $image $manifestdir/ - # And the top-level Fedora-specific manifests - if [ -f $image.hidden.yaml ]; then - cp -a $image.hidden.yaml $manifestdir/ - else - cp -a $image.yaml $manifestdir/ - fi - # And the legacy `fedora-` prefixed names + # And the Fedora-specific tweaks cp -a fedora-$image.yaml $manifestdir/ done -# ELN is rawhide-only and should be removed when stable branches are created -# (manually remove eln/ directory and fedora-eln.yaml when branching for new releases) -if [ -d eln ]; then - cp -a eln $manifestdir/ - cp -a fedora-eln.yaml $manifestdir/ -fi # Set the default ln -s fedora-standard.yaml $manifestdir/default.yaml # And install dependency manifests diff --git a/iot.yaml b/iot.yaml deleted file mode 100644 index 27aabce3..00000000 --- a/iot.yaml +++ /dev/null @@ -1,4 +0,0 @@ -include: - - iot/manifest.yaml - - fedora-minimal-plus.yaml - diff --git a/iot/manifest.yaml b/iot/manifest.yaml deleted file mode 100644 index 52922a8f..00000000 --- a/iot/manifest.yaml +++ /dev/null @@ -1,59 +0,0 @@ -metadata: - summary: Fedora IoT bootc image - -variables: - distro: "fedora-iot" - -packages: - - fedora-release-iot - - fedora-iot-config - - atheros-firmware - - brcmfmac-firmware - - chrony - - clevis - - clevis-dracut - - clevis-luks - - clevis-pin-tpm2 - - containernetworking-plugins - - dnf5-plugins - - dracut-config-generic - - dracut-network - - fdo-client - - fdo-owner-cli - - firewalld - - fwupd-efi - - fwupd-plugin-modem-manager - - fwupd-plugin-uefi-capsule-data - - greenboot - - greenboot-default-health-checks - - ignition - - ignition-edge - - ima-evm-utils - - iputils - - iwd - - iwlwifi-mvm-firmware - - libsss_sudo - - NetworkManager-wifi - - NetworkManager-wwan - - openssl - - pinentry - - procps-ng - - realtek-firmware - - rootfiles - - screen - - setools-console - - slirp4netns - - ssh-key-dir - - sssd-client - - tmux - - tpm2-pkcs11 - - traceroute - - usbguard - - wpa_supplicant - - wireless-regdb -packages-aarch64: - - arm-image-installer - - bcm283x-firmware - - optee_client - - uboot-images-armv8 - diff --git a/minimal-plus.hidden.yaml b/minimal-plus.hidden.yaml deleted file mode 100644 index a987b388..00000000 --- a/minimal-plus.hidden.yaml +++ /dev/null @@ -1,3 +0,0 @@ -include: - - fedora-includes/generic.yaml - - minimal-plus/manifest.yaml diff --git a/minimal.yaml b/minimal.yaml deleted file mode 100644 index a6b3b236..00000000 --- a/minimal.yaml +++ /dev/null @@ -1,3 +0,0 @@ -include: - - fedora-includes/generic.yaml - - minimal/manifest.yaml diff --git a/minimal/basic-fixes.yaml b/minimal/basic-fixes.yaml index c636e8c6..7043309e 100644 --- a/minimal/basic-fixes.yaml +++ b/minimal/basic-fixes.yaml @@ -23,13 +23,7 @@ postprocess: # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't # work if we want to use tmpfiles.d to write to `/root/.ssh` because # tmpfiles gives up on that before getting to `/var/roothome`. - # - # Redirect stdout to /dev/null because of some weird stdout issue - # with newer rpm-ostree: https://github.com/coreos/rpm-ostree/pull/5388#issuecomment-2971623787 - sed -i -e 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf > /dev/null + sed -i -e 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf # Because /var/roothome is also defined in rpm-ostree-0-integration.conf # we need to delete /var/roothome - # - # Redirect stdout to /dev/null because of some weird stdout issue - # with newer rpm-ostree: https://github.com/coreos/rpm-ostree/pull/5388#issuecomment-2971623787 - sed -i -e '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf > /dev/null + sed -i -e '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf diff --git a/minimal/bootc.yaml b/minimal/bootc.yaml index 3975c14c..d98497d3 100644 --- a/minimal/bootc.yaml +++ b/minimal/bootc.yaml @@ -1,11 +1,17 @@ # The bootc components. packages: - # systemd. Also name systemd-pam because it was dropped to a recommends - # but we still want it for handling user logins/sessions. - # dbus is required per https://bugzilla.redhat.com/show_bug.cgi?id=2507313 - - systemd systemd-pam dbus - # bootc itself. + - systemd - bootc # Required by bootc install, sgdisk has been replaced by Rust crate # in bootc https://github.com/containers/bootc/pull/775 - xfsprogs e2fsprogs dosfstools + +exclude-packages: + # bootc pulls in podman, which pulls in containers-common, which wants + # `iptables`. That may pull in iptables-legacy which we don't want; + # we want iptables-nft to win the Provides by default + - iptables-legacy + # Exclude kernel-debug-core to make sure that it doesn't somehow get + # chosen as the package to satisfy the `kernel-core` dependency from + # the kernel package. + - kernel-debug-core diff --git a/minimal/bootupd.yaml b/minimal/bootupd.yaml index 29323179..6b55aa3a 100644 --- a/minimal/bootupd.yaml +++ b/minimal/bootupd.yaml @@ -8,14 +8,6 @@ packages-aarch64: - grub2-efi-aa64 efibootmgr shim packages-ppc64le: - grub2 ostree-grub2 -packages-riscv64: - - grub2-efi-riscv64 efibootmgr - # Don't specify just `shim` for now because riscv isn't built in - # main koji instance yet and thus isn't signed. Here we specify - # the path to the provided file so when we do switch to the signed - # `shim` package it will transparently happen and we can clean up - # this packagelist entry later. - - /boot/efi/EFI/fedora/shimriscv64.efi packages-s390x: # For zipl - s390utils-core diff --git a/minimal/check-passwd-nobody.yaml b/minimal/check-passwd-nobody.yaml deleted file mode 100644 index b7d3ba3d..00000000 --- a/minimal/check-passwd-nobody.yaml +++ /dev/null @@ -1,6 +0,0 @@ -check-passwd: - type: "file" - filename: "passwd-nobody" -check-groups: - type: "file" - filename: "group-nobody" diff --git a/minimal/check-passwd.yaml b/minimal/check-passwd.yaml deleted file mode 100644 index 3af21147..00000000 --- a/minimal/check-passwd.yaml +++ /dev/null @@ -1,6 +0,0 @@ -check-passwd: - type: "file" - filename: "passwd" -check-groups: - type: "file" - filename: "group" diff --git a/minimal/group b/minimal/group index 5d5326c3..c4c44b73 100644 --- a/minimal/group +++ b/minimal/group @@ -1,5 +1,3 @@ -# keep sorted by GID (e.g. pass through `sort -t: --key 3 -g`) - root:x:0: bin:x:1: daemon:x:2: @@ -17,31 +15,31 @@ man:x:15: dialout:x:18: floppy:x:19: games:x:20: -rpcuser:x:29: tape:x:33: video:x:39: -dip:x:40: ftp:x:50: lock:x:54: audio:x:63: -tcpdump:x:72: nobody:x:99: users:x:100: -input:x:104: -ceph:x:167: -avahi-autoipd:x:170: -systemd-journal:x:190: -dockerroot:x:986: -cockpit-ws:x:987: -systemd-bus-proxy:x:988: -systemd-resolve:x:989: -systemd-network:x:990: -systemd-timesync:x:991: -chrony:x:992: -sssd:x:993: -kube:x:994: -cgred:x:996: -etcd:x:997: -polkitd:x:998: ssh_keys:x:999: +systemd-journal:x:190: +polkitd:x:998: +etcd:x:997: +dip:x:40: +cgred:x:996: +avahi-autoipd:x:170: +sssd:x:993: +dockerroot:x:986: +rpcuser:x:29: nfsnobody:x:65534: +kube:x:994: +chrony:x:992: +tcpdump:x:72: +ceph:x:167: +input:x:104: +systemd-timesync:x:991: +systemd-network:x:990: +systemd-resolve:x:989: +systemd-bus-proxy:x:988: +cockpit-ws:x:987: diff --git a/minimal/group-nobody b/minimal/group-nobody deleted file mode 100644 index f2d71b64..00000000 --- a/minimal/group-nobody +++ /dev/null @@ -1,4 +0,0 @@ -# this is used with the --nobody-99 option for backwards compatibility with -# systems that had nobody set to 99 -nobody:x:99: -nfsnobody:x:65534: diff --git a/minimal/initramfs.yaml b/minimal/initramfs.yaml index 0256d9cd..fe4bbeb7 100644 --- a/minimal/initramfs.yaml +++ b/minimal/initramfs.yaml @@ -2,15 +2,11 @@ postprocess: - | #!/usr/bin/env bash - set -xeuo pipefail mkdir -p /usr/lib/dracut/dracut.conf.d cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' # We want a generic image; hostonly makes no sense as part of a server side build hostonly=no - # Dracut will always fail to set security.selinux xattrs at build time - # https://github.com/dracut-ng/dracut-ng/issues/1561 - export DRACUT_NO_XATTR=1 - add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree bootc " + add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " EOF cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' # Extra modules that we want by default that are known to exist in the kernel diff --git a/minimal/kernel-install.yaml b/minimal/kernel-install.yaml index 2df40d67..1d75cd93 100644 --- a/minimal/kernel-install.yaml +++ b/minimal/kernel-install.yaml @@ -4,11 +4,10 @@ postprocess: #!/usr/bin/env bash set -xeuo pipefail source /usr/lib/os-release - mkdir -p /usr/lib/kernel/install.conf.d echo -e "# kernel-install will not try to run dracut and allow rpm-ostree to\n\ # take over. Rpm-ostree will use this to know that it is responsible\n\ # to run dracut and ensure that there is only one kernel in the image\n\ - layout=ostree" | tee /usr/lib/kernel/install.conf /usr/lib/kernel/install.conf.d/00-bootc-kernel-layout.conf > /dev/null + layout=ostree" | tee /usr/lib/kernel/install.conf > /dev/null # By default dnf keeps multiple versions of the kernel, with this # configuration we tell dnf to treat the kernel as everything else. # https://dnf.readthedocs.io/en/latest/conf_ref.html#main-options diff --git a/minimal/kernel.yaml b/minimal/kernel.yaml index 89213484..0dd777d1 100644 --- a/minimal/kernel.yaml +++ b/minimal/kernel.yaml @@ -4,9 +4,3 @@ packages: exclude-packages: - kernel-debug - - kernel-debug-core - - kernel-debug-modules - - kernel-debug-modules-core - - kernel-debug-modules-extra - - kernel-debug-uki-virt - - kernel-debug-uki-virt-addons diff --git a/minimal/manifest.yaml b/minimal/manifest.yaml index 411a026b..2c4a62e6 100644 --- a/minimal/manifest.yaml +++ b/minimal/manifest.yaml @@ -3,9 +3,6 @@ metadata: edition: "2024" -variables: - passwd_mode: full - # Be minimal recommends: false @@ -16,6 +13,9 @@ container-cmd: remove-from-packages: # Generally we expect other tools to do this (e.g. Ignition or cloud-init) - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service] + # We don't want auto-generated mount units. See also + # https://github.com/systemd/systemd/issues/13099 + - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] include: - kernel.yaml @@ -27,7 +27,6 @@ include: - initramfs.yaml - basic-fixes.yaml - kernel-install.yaml - - systemd-presets.yaml packages: # this is implied by dependencies but let's make it explicit @@ -43,6 +42,3 @@ packages: - container-selinux # Needed for tpm2 bound luks - tpm2-tools - # Need kmscon for enhanced VT console - # https://fedoraproject.org/wiki/Changes/UseKmsconVTConsole - - kmscon diff --git a/minimal/ostree.yaml b/minimal/ostree.yaml index 99e256ed..af495808 100644 --- a/minimal/ostree.yaml +++ b/minimal/ostree.yaml @@ -5,7 +5,6 @@ postprocess: # Set up default root config - | #!/usr/bin/env bash - set -xeuo pipefail mkdir -p /usr/lib/ostree cat > /usr/lib/ostree/prepare-root.conf << EOF [composefs] diff --git a/minimal/passwd b/minimal/passwd index bf8fc7c7..9c3b4b27 100644 --- a/minimal/passwd +++ b/minimal/passwd @@ -1,34 +1,32 @@ -# keep sorted by UID (e.g. pass through `sort -t: --key 3 -g`) - -root:x:0:0:Super User:/root:/bin/bash -bin:x:1:1:bin:/bin:/usr/sbin/nologin -daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin adm:x:3:4:adm:/var/adm:/usr/sbin/nologin -lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin -sync:x:5:0:sync:/sbin:/bin/sync -shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown -halt:x:7:0:halt:/sbin:/sbin/halt -mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin -operator:x:11:0:operator:/root:/usr/sbin/nologin -games:x:12:100:games:/usr/games:/usr/sbin/nologin -ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin -rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin -rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin -tcpdump:x:72:72::/:/usr/sbin/nologin -sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin -dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin -nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin -ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin -cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin -systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin -systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin -systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin -systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin +bin:x:1:1:bin:/bin:/usr/sbin/nologin +ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin -sssd:x:995:993:User for sssd:/run/sssd:/usr/sbin/nologin -kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin +cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin +daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin +dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin -polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin +ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin +games:x:12:100:games:/usr/games:/usr/sbin/nologin +halt:x:7:0:halt:/sbin:/sbin/halt +kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin +lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin +mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin +nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin +operator:x:11:0:operator:/root:/usr/sbin/nologin +polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin +root:x:0:0:Super User:/root:/bin/bash +rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin +rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin +shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown +sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin +sssd:x:995:993:User for sssd:/run/sssd:/usr/sbin/nologin +sync:x:5:0:sync:/sbin:/bin/sync +systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin +systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin +systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin +systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin +tcpdump:x:72:72::/:/usr/sbin/nologin diff --git a/minimal/passwd-nobody b/minimal/passwd-nobody deleted file mode 100644 index 44d28664..00000000 --- a/minimal/passwd-nobody +++ /dev/null @@ -1,4 +0,0 @@ -# this is used with the --nobody-99 option for backwards compatibility with -# systems that had nobody set to 99 -nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin -nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin diff --git a/minimal/postprocess-conf.yaml b/minimal/postprocess-conf.yaml index 75762add..6b54a774 100644 --- a/minimal/postprocess-conf.yaml +++ b/minimal/postprocess-conf.yaml @@ -14,25 +14,14 @@ ignore-removed-users: - root ignore-removed-groups: - root -# By default users and groups are injected to nss-altfiles -# which is immutable. This list moves a selected set -# to /etc/group instead, which is mutable per system -# and allows local users to become part of these groups. etc-group-members: - wheel - systemd-journal - - tss # https://issues.redhat.com/browse/BIFROST-618 - - kvm # https://issues.redhat.com/browse/RHEL-115278 - adm -conditional-include: - - if: passwd_mode == "full" - include: check-passwd.yaml - - if: passwd_mode == "nobody" - include: check-passwd-nobody.yaml - - if: passwd_mode == "none" - include: - check-passwd: - type: "none" - check-groups: - type: "none" +check-passwd: + type: "file" + filename: "passwd" +check-groups: + type: "file" + filename: "group" diff --git a/minimal/systemd-presets.yaml b/minimal/systemd-presets.yaml deleted file mode 100644 index 6bedd4f4..00000000 --- a/minimal/systemd-presets.yaml +++ /dev/null @@ -1,43 +0,0 @@ -# Postprocessing relating to systemd presets on the system. -postprocess: - - | - #!/bin/bash - set -xeuo pipefail - # Override some of the default presets. - cat < usr/lib/systemd/system-preset/85-bootc.preset - # Disable dnf-makecache.timer on bootc/image mode systems - # https://github.com/coreos/fedora-coreos-tracker/issues/1896#issuecomment-2848251507 - disable dnf-makecache.timer - EOF - # Enable bootloader-update.service on F43+ and CentOS9+ - # https://github.com/coreos/fedora-coreos-tracker/issues/1468#issuecomment-2996654547 - # https://fedoraproject.org/wiki/Changes/AutomaticBootloaderUpdatesBootc - - | - #!/bin/bash - set -xeuo pipefail - source /usr/lib/os-release - - preset_file_name=/usr/lib/systemd/system-preset/85-bootc-bootloader-update.preset - - case "$ID" in - fedora) - if [ "$VERSION_ID" -ge 43 ]; then - echo "enable bootloader-update.service" >> "$preset_file_name" - fi - ;; - centos) - if [ "$VERSION_ID" -ge 9 ]; then - echo "enable bootloader-update.service" >> "$preset_file_name" - fi - ;; - *) ;; - esac - # Undo RPM scripts enabling units; we want the presets to be canonical - # https://github.com/projectatomic/rpm-ostree/issues/1803 - - | - #!/bin/bash - set -xeuo pipefail - rm -rf /etc/systemd/system/* - systemctl preset-all - rm -rf /etc/systemd/user/* - systemctl --user --global preset-all diff --git a/minimal/tmpfiles.yaml b/minimal/tmpfiles.yaml index e9846cbf..d37ef7f5 100644 --- a/minimal/tmpfiles.yaml +++ b/minimal/tmpfiles.yaml @@ -1,18 +1,7 @@ postprocess: - | #!/bin/bash - set -xeuo pipefail cat >/usr/lib/tmpfiles.d/bootc-base-rpmstate.conf <<'EOF' # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=771713 d /var/lib/rpm-state 0755 - - - EOF - cat > /usr/lib/tmpfiles.d/konflux-buildinfo-contentsets.conf <<'EOF' - # Workaround for https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243 - d /var/roothome/buildinfo 0755 - - - - d /var/roothome/buildinfo/content_manifests 0755 - - - - # Note we don't actually try to recreate the content; this just makes the linter ignore it - f /var/roothome/buildinfo/content_manifests/content-sets.json 0644 - - - - f /var/roothome/buildinfo/labels.json 0644 - - - - EOF - # Workaround for https://issues.redhat.com/browse/RHEL-106203 - rm -f /usr/lib/tmpfiles.d/home.conf diff --git a/renovate.json b/renovate.json index 50ab8d08..c29201bd 100644 --- a/renovate.json +++ b/renovate.json @@ -1,203 +1,19 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "description": [ - "Renovate configuration for bootc-base-image repository.", - "", - "This configuration separates updates into different PRs per release (e.g., Fedora 44, Rawhide)", - "to prevent blocking all releases if tests fail on one.", - "", - "Update schedules:", - "- Fedora 43 bootc-pipeline: 2-5 AM UTC daily", - "- Fedora 43 REPOS_IMAGE: at any time", - "- Fedora 44 bootc-pipeline: 2-5 AM UTC daily", - "- Fedora 44 REPOS_IMAGE: at any time", - "- Fedora 45 bootc-pipeline: 2-5 AM UTC daily", - "- Fedora 45 REPOS_IMAGE: at any time", - "- Rawhide bootc-pipeline: 2-5 AM UTC daily", - "- Rawhide REPOS_IMAGE: at any time", - "", - "Each update type (bootc-pipeline, REPOS_IMAGE) also has its own PR", - "for independent review and merge.", - "", - "rebaseWhen is set to 'never' for REPOS_IMAGE PRs because as different PRs", - "for each release are merged to main, automatic rebasing would reset pipelines", - "and cause tests to rerun multiple times. The operator can manually rebase if needed.", - "", - "Automerge is enabled for all PRs - they will be merged automatically when all checks pass." - ], "extends": [ "github>platform-engineering-org/.github" ], - "dependencyDashboard": true, - "automergeType": "pr", - "enabledManagers": [ - "custom.regex", - "tekton" - ], - "tekton": { - "additionalBranchPrefix": "", - "includePaths": [ - ".tekton/**" - ], - "managerFilePatterns": [ - "/\\.ya?ml$/" - ] - }, - "baseBranchPatterns": [ - "main" - ], - "customManagers": [ - { - "customType": "regex", - "description": [ - "Update 'REPOS_IMAGE' in tekton files" - ], - "managerFilePatterns": [ - "/.tekton/.*\\.ya?ml$/" - ], - "matchStrings": [ - "REPOS_IMAGE=(?.*):(?.*)@(?.*)\\n" - ], - "versioningTemplate": "regex:(?.*)-(?\\d{8})(\\.n)?\\.(?\\d)", - "datasourceTemplate": "docker" - } - ], + "baseBranches": ["main", "f40", "f41"], "packageRules": [ { - "description": [ - "Disable REPOS_IMAGE updates for 44-iot, 45-iot and rawhide-iot tekton files", - "until we fix https://gitlab.com/fedora/bootc/base-images/-/issues/74" - ], - "matchManagers": ["custom.regex", "tekton"], - "matchFileNames": [".tekton/*-44-iot-*", ".tekton/*-45-iot-*", ".tekton/*-rawhide-iot-*"], - "enabled": false + "matchPackageNames": ["quay.io/fedora/fedora"], + "allowedVersions": "=40", + "matchBaseBranches": ["f40"] }, { - "matchManagers": ["tekton"], - "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"], - "matchFileNames": [".tekton/fedora-bootc-43-*"], - "groupName": "Fedora 43 bootc-pipeline", - "groupSlug": "fedora-43-bootc-pipeline", - "branchPrefix": "renovate/fedora-43/", - "commitMessageTopic": "Fedora 43 bootc build pipeline", - "schedule": ["after 2am and before 5am"], - "timezone": "UTC", - "recreateWhen": "always", - "rebaseWhen": "always", - "additionalBranchPrefix": "", - "automerge": true - }, - { - "matchManagers": ["custom.regex"], - "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-43-compose/"], - "matchFileNames": [".tekton/fedora-bootc-43-*"], - "groupName": "Fedora 43 REPOS_IMAGE", - "groupSlug": "fedora-43-repos-image", - "branchPrefix": "renovate/fedora-43/", - "commitMessageTopic": "Fedora 43 REPOS_IMAGE", - "schedule": ["at any time"], - "recreateWhen": "always", - "rebaseWhen": "never", - "additionalBranchPrefix": "", - "automerge": true - }, - { - "matchManagers": ["tekton"], - "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"], - "matchFileNames": [".tekton/fedora-bootc-44-*"], - "groupName": "Fedora 44 bootc-pipeline", - "groupSlug": "fedora-44-bootc-pipeline", - "branchPrefix": "renovate/fedora-44/", - "commitMessageTopic": "Fedora 44 bootc build pipeline", - "schedule": ["after 2am and before 5am"], - "timezone": "UTC", - "recreateWhen": "always", - "rebaseWhen": "always", - "additionalBranchPrefix": "", - "automerge": true - }, - { - "matchManagers": ["custom.regex"], - "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-44-compose/"], - "matchFileNames": [".tekton/fedora-bootc-44-*"], - "groupName": "Fedora 44 REPOS_IMAGE", - "groupSlug": "fedora-44-repos-image", - "branchPrefix": "renovate/fedora-44/", - "commitMessageTopic": "Fedora 44 REPOS_IMAGE", - "schedule": ["at any time"], - "recreateWhen": "always", - "rebaseWhen": "never", - "additionalBranchPrefix": "", - "automerge": true - }, - { - "matchManagers": ["tekton"], - "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"], - "matchFileNames": [".tekton/fedora-bootc-45-*"], - "groupName": "Fedora 45 bootc-pipeline", - "groupSlug": "fedora-45-bootc-pipeline", - "branchPrefix": "renovate/fedora-45/", - "commitMessageTopic": "Fedora 45 bootc build pipeline", - "schedule": ["after 2am and before 5am"], - "timezone": "UTC", - "recreateWhen": "always", - "rebaseWhen": "always", - "additionalBranchPrefix": "", - "automerge": true - }, - { - "matchManagers": ["custom.regex"], - "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-45-compose/"], - "matchFileNames": [".tekton/fedora-bootc-45-*"], - "groupName": "Fedora 45 REPOS_IMAGE", - "groupSlug": "fedora-45-repos-image", - "branchPrefix": "renovate/fedora-45/", - "commitMessageTopic": "Fedora 45 REPOS_IMAGE", - "schedule": ["at any time"], - "recreateWhen": "always", - "rebaseWhen": "never", - "additionalBranchPrefix": "", - "automerge": true - }, - { - "matchManagers": ["tekton"], - "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"], - "matchFileNames": [".tekton/fedora-bootc-rawhide-*"], - "groupName": "Fedora Rawhide bootc-pipeline", - "groupSlug": "fedora-rawhide-bootc-pipeline", - "branchPrefix": "renovate/fedora-rawhide/", - "commitMessageTopic": "Fedora Rawhide bootc build pipeline", - "schedule": ["after 2am and before 5am"], - "timezone": "UTC", - "recreateWhen": "always", - "rebaseWhen": "always", - "additionalBranchPrefix": "", - "automerge": true - }, - { - "matchManagers": ["custom.regex"], - "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-rawhide-compose/"], - "matchFileNames": [".tekton/fedora-bootc-rawhide-*"], - "groupName": "Fedora Rawhide REPOS_IMAGE", - "groupSlug": "fedora-rawhide-repos-image", - "branchPrefix": "renovate/fedora-rawhide/", - "commitMessageTopic": "Fedora Rawhide REPOS_IMAGE", - "schedule": ["at any time"], - "recreateWhen": "always", - "rebaseWhen": "never", - "additionalBranchPrefix": "", - "automerge": true - }, - { - "matchPackageNames": [ - "/quay.io/bootc-devel/fedora-bootc-eln-compose/" - ], - "groupName": "Fedora ELN compose dependencies", - "groupSlug": "fedora-eln-compose-dependencies", - "schedule": [ - "at any time" - ], - "automerge": true + "matchPackageNames": ["quay.io/fedora/fedora"], + "allowedVersions": "=41", + "matchBaseBranches": ["f41"] } ] } diff --git a/standard.yaml b/standard.yaml deleted file mode 100644 index debffcd8..00000000 --- a/standard.yaml +++ /dev/null @@ -1,11 +0,0 @@ -include: - - fedora-includes/generic.yaml - - standard/manifest.yaml - -packages: - # Make Ansible "package" builtin work by default - - python3-libdnf5 - # Content-based container layer splitting for rechunking - # Note we should be able to move this back to the base standard/manifest.yaml - # once chunkah is in CentOS Stream and RHEL. - - chunkah diff --git a/standard/autoupdates.yaml b/standard/autoupdates.yaml new file mode 100644 index 00000000..a416699b --- /dev/null +++ b/standard/autoupdates.yaml @@ -0,0 +1,9 @@ +# Enable automatic updates by default +postprocess: + - | + #!/usr/bin/env bash + set -euo pipefail + target=/usr/lib/systemd/system/default.target.wants + mkdir -p $target + set -x + ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/standard/bootc-generic-growpart b/standard/bootc-generic-growpart index 2a7b43e1..cc620514 100755 --- a/standard/bootc-generic-growpart +++ b/standard/bootc-generic-growpart @@ -14,14 +14,9 @@ if ! test -d "${syspath}"; then echo "failed to find backing device ${syspath}"; exit 1 fi -# Only partitions have a "partition" attribute in sysfs. A rootfs on an -# mdraid array, on a device-mapper node, or directly on a whole disk has -# nothing here for us to grow, and growing those is a different -# operation. Skip rather than fail, so that the unit does not leave an -# otherwise healthy system "degraded". -if ! test -f "${syspath}"/partition; then - echo "Not growing ${backing_device}: not a partition"; exit 0 -fi + + +# Note that we expect that the rootfs is on a partition partition=$(cat "${syspath}"/partition) # Walk up to find the parent blockdev diff --git a/standard/coreos-user-experience.yaml b/standard/coreos-user-experience.yaml index 1ca64630..10980944 100644 --- a/standard/coreos-user-experience.yaml +++ b/standard/coreos-user-experience.yaml @@ -8,14 +8,7 @@ packages: - console-login-helper-messages-profile # kdump support # https://github.com/coreos/fedora-coreos-tracker/issues/622 - # The makedumpfile and kdump-utils RPMs were broken out in - # Fedora and EL10+. To be able to use the same package list - # Across EL9 + Fedora + EL10 let's just name paths for now. - # We can go back to just specifying the RPM names when we - # no longer support EL9. - kexec-tools - - /usr/share/makedumpfile # makedumpfile RPM - - /usr/bin/kdumpctl # kdump-utils RPM # Container tooling - toolbox # nvme-cli for managing nvme disks diff --git a/standard/generic-growfs.yaml b/standard/generic-growfs.yaml index 0604cdb0..f64be924 100644 --- a/standard/generic-growfs.yaml +++ b/standard/generic-growfs.yaml @@ -7,7 +7,6 @@ add-files: postprocess: - | #!/bin/bash - set -xeuo pipefail - chmod 0644 /usr/lib/systemd/system/bootc-generic-growpart.service + set -euo pipefail mkdir -p /usr/lib/systemd/system/local-fs.target.wants ln -s ../bootc-generic-growpart.service /usr/lib/systemd/system/local-fs.target.wants/bootc-generic-growpart.service diff --git a/standard/initramfs-full.yaml b/standard/initramfs-full.yaml index cc9179d1..b84a4987 100644 --- a/standard/initramfs-full.yaml +++ b/standard/initramfs-full.yaml @@ -2,19 +2,7 @@ postprocess: - | #!/usr/bin/env bash - set -xeuo pipefail mkdir -p /usr/lib/dracut/dracut.conf.d cat > /usr/lib/dracut/dracut.conf.d/30-bootc-standard.conf << 'EOF' add_dracutmodules+=" lvm crypt fips " EOF - # Clevis in initramfs for LUKS auto-unlock. - # clevis-pin-tpm2 is only on x86_64/aarch64 (TPM2 hardware arches). - if test -x /usr/bin/clevis-pin-tpm2; then - cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF' - add_dracutmodules+=" clevis clevis-pin-tpm2 " - EOF - else - cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF' - add_dracutmodules+=" clevis " - EOF - fi diff --git a/standard/manifest.yaml b/standard/manifest.yaml index 51820946..4810817c 100644 --- a/standard/manifest.yaml +++ b/standard/manifest.yaml @@ -9,13 +9,13 @@ recommends: true include: - ../minimal-plus/manifest.yaml + - autoupdates.yaml - networking-tools.yaml - system-configuration.yaml - coreos-user-experience.yaml - persistent-journal.yaml - initramfs-full.yaml - generic-growfs.yaml - - systemd-presets.yaml packages: # Include and set the default editor @@ -24,6 +24,7 @@ packages: # Additional firewall support; we aren't including these in RHCOS or they # don't exist in RHEL - iptables-services + - WALinuxAgent-udev # Allow communication between sudo and SSSD # for caching sudo rules by SSSD. # https://github.com/coreos/fedora-coreos-tracker/issues/445 @@ -41,19 +42,10 @@ packages: - zram-generator # This one is in Python so isn't in FCOS, but we can safely add it here. - sos - # Make Ansible "package_facts" builtin work by default - - python3-rpm - # Initramfs Clevis for LUKS auto-unlock (dracut modules wired in initramfs-full.yaml) - - clevis-dracut - # Used by admins interactively - - man-db # These are random architecture-specific packages packages-x86_64: - irqbalance - - WALinuxAgent-udev - # TPM2 pin for Clevis LUKS auto-unlock - - clevis-pin-tpm2 packages-ppc64le: - irqbalance - librtas @@ -61,9 +53,26 @@ packages-ppc64le: - ppc64-diag-rtas packages-aarch64: - irqbalance - - WALinuxAgent-udev - # TPM2 pin for Clevis LUKS auto-unlock - - clevis-pin-tpm2 + +postprocess: + # Undo RPM scripts enabling units; we want the presets to be canonical + # https://github.com/projectatomic/rpm-ostree/issues/1803 + - | + #!/usr/bin/env bash + set -xeuo pipefail + rm -rf /etc/systemd/system/* + systemctl preset-all + rm -rf /etc/systemd/user/* + systemctl --user --global preset-all + # See: https://github.com/coreos/fedora-coreos-tracker/issues/1253 + # https://bugzilla.redhat.com/show_bug.cgi?id=2112857 + # https://github.com/coreos/rpm-ostree/issues/3918 + # Temporary workaround to remove the SetGID binary from liblockfile that is + # pulled by the s390utils but not needed for /usr/sbin/zipl. + - | + #!/usr/bin/env bash + set -xeuo pipefail + rm -f /usr/bin/dotlockfile # Things we don't expect to ship on the host. We currently # have recommends: false so these could only come in via @@ -73,7 +82,7 @@ exclude-packages: - perl-interpreter - nodejs - grubby - - cowsay # Just in case + - cowsay # Just in case # Let's make sure initscripts doesn't get pulled back in # https://github.com/coreos/fedora-coreos-tracker/issues/220#issuecomment-611566254 - initscripts diff --git a/standard/persistent-journal.yaml b/standard/persistent-journal.yaml index bb2d0c96..ccc6c5f8 100644 --- a/standard/persistent-journal.yaml +++ b/standard/persistent-journal.yaml @@ -5,9 +5,7 @@ # rid of this once we move to sysusers and create the dir in the initrd. postprocess: - - | - #!/bin/bash - set -xeuo pipefail + - | #!/bin/bash mkdir -p /usr/lib/systemd/journald.conf.d/ cat >/usr/lib/systemd/journald.conf.d/10-centos-bootc-persistent.conf << EOF [Journal] diff --git a/standard/systemd-presets.yaml b/standard/systemd-presets.yaml deleted file mode 100644 index 6ab01ee0..00000000 --- a/standard/systemd-presets.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Postprocessing relating to systemd presets on the system. -# -# Note this relies on the `systemctl preset-all` run from -# minimal/systemd-presets.yaml running after this postprocess. -postprocess: - # Enable automatic updates by default - - | - #!/bin/bash - set -xeuo pipefail - # Enable automatic updates by default - cat < usr/lib/systemd/system-preset/86-bootc-standard.preset - # Enable automatic updates by default - enable bootc-fetch-apply-updates.timer - EOF diff --git a/tests/Containerfile.test-derive b/tests/Containerfile.test-derive index 72864ff4..52cd0a76 100644 --- a/tests/Containerfile.test-derive +++ b/tests/Containerfile.test-derive @@ -1,13 +1,11 @@ -# This test case exercises using the fedora-bootc image as a builder to -# generate a minimal target image, and then further extends it in a secondary -# phase. +# This test case exercises using the fedora-bootc image as a builder +# to generate a minimal target image derived from CentOS Stream 10 content, +# and then further extends it in a secondary phase. +FROM quay.io/fedora/fedora-bootc:rawhide as repos # This is intentionally a locally built image FROM localhost/fedora-bootc as builder -RUN < args.txt -/usr/libexec/bootc-base-imagectl --args-file args.txt build-rootfs --manifest=standard/manifest /target-rootfs -EORUN +RUN --mount=type=bind,from=repos,src=/,dst=/repos,rw /usr/libexec/bootc-base-imagectl build-rootfs --manifest=standard/manifest /repos /target-rootfs # This pulls in the rootfs generated in the previous step FROM scratch @@ -17,8 +15,6 @@ set -xeuo pipefail . /usr/lib/os-release test "$ID" = fedora -rpm -q ltrace - # And install a package dnf -y install strace dnf clean all diff --git a/tests/Containerfile.test-sysusers b/tests/Containerfile.test-sysusers deleted file mode 100644 index 37165e00..00000000 --- a/tests/Containerfile.test-sysusers +++ /dev/null @@ -1,38 +0,0 @@ -# This test case exercises --sysusers. - -# This is intentionally a locally built image -FROM localhost/fedora-bootc as builder -RUN < overlay/usr/lib/sysusers.d/00-chrony.conf </dev/null - # and these need to be directly in /etc - grep -q $grp /etc/group -done diff --git a/tests/rootfs/cases/fedora-only b/tests/rootfs/cases/fedora-only deleted file mode 100755 index d44148c9..00000000 --- a/tests/rootfs/cases/fedora-only +++ /dev/null @@ -1,13 +0,0 @@ -#!/bin/bash -set -xeuo pipefail -. /usr/lib/os-release -case "${ID}" in - fedora) - # https://gitlab.com/fedora/bootc/base-images/-/merge_requests/172 - if rpm -q python3 &>/dev/null; then - rpm -q python3-libdnf5 - fi - ;; - *) - ;; -esac diff --git a/tests/rootfs/cases/no-iptables-legacy b/tests/rootfs/cases/no-iptables-legacy deleted file mode 100755 index 0100c5d9..00000000 --- a/tests/rootfs/cases/no-iptables-legacy +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/bash -set -xeuo pipefail -output=$(rpm -q iptables-legacy || true) -grep "is not installed" <<< "$output" diff --git a/tests/rootfs/cases/tmpfiles-konflux-buildinfo b/tests/rootfs/cases/tmpfiles-konflux-buildinfo deleted file mode 100755 index e03a3b63..00000000 --- a/tests/rootfs/cases/tmpfiles-konflux-buildinfo +++ /dev/null @@ -1,18 +0,0 @@ -#!/bin/bash -set -xeuo pipefail -# Verify our custom tmpfiles.d configs by actually running systemd-tmpfiles -# against a temporary root and checking the expected paths are created. -# Workaround for https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243 - -tmproot=$(mktemp -d) -trap 'rm -rf "${tmproot}"' EXIT - -systemd-tmpfiles --create --root="${tmproot}" \ - /usr/lib/tmpfiles.d/bootc-base-rpmstate.conf \ - /usr/lib/tmpfiles.d/konflux-buildinfo-contentsets.conf - -test -d "${tmproot}/var/lib/rpm-state" -test -d "${tmproot}/var/roothome/buildinfo" -test -d "${tmproot}/var/roothome/buildinfo/content_manifests" -test -f "${tmproot}/var/roothome/buildinfo/content_manifests/content-sets.json" -test -f "${tmproot}/var/roothome/buildinfo/labels.json"