From 149f62a7759835e1ab03bd0c86ad7c5413dd3fa5 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Wed, 22 Jul 2026 18:52:28 +0200 Subject: [PATCH 1/2] Backport add image labels --- .tekton/acs-mcp-server-pull-request.yaml | 4 ++ .tekton/acs-mcp-server-push.yaml | 4 ++ .tekton/basic-component-pipeline.yaml | 73 +++++++++++++++++++++++- konflux.Dockerfile | 18 ++++++ 4 files changed, 98 insertions(+), 1 deletion(-) diff --git a/.tekton/acs-mcp-server-pull-request.yaml b/.tekton/acs-mcp-server-pull-request.yaml index fb1fb20..86ef59a 100644 --- a/.tekton/acs-mcp-server-pull-request.yaml +++ b/.tekton/acs-mcp-server-pull-request.yaml @@ -54,6 +54,10 @@ spec: value: '0' - name: clone-fetch-tags value: 'true' + - name: extra-labels + value: + # X.Y in the cpe label must be adjusted for every version stream. + - "cpe=cpe:/a:redhat:agentic_cluster_security_suite:X.Y::el9" pipelineRef: name: basic-component-pipeline diff --git a/.tekton/acs-mcp-server-push.yaml b/.tekton/acs-mcp-server-push.yaml index 903aba3..20be39e 100644 --- a/.tekton/acs-mcp-server-push.yaml +++ b/.tekton/acs-mcp-server-push.yaml @@ -68,6 +68,10 @@ spec: - linux/arm64 - linux/ppc64le - linux/s390x + - name: extra-labels + value: + # X.Y in the cpe label must be adjusted for every version stream. + - "cpe=cpe:/a:redhat:agentic_cluster_security_suite:X.Y::el9" pipelineRef: name: basic-component-pipeline diff --git a/.tekton/basic-component-pipeline.yaml b/.tekton/basic-component-pipeline.yaml index 17c89fe..bd712d3 100644 --- a/.tekton/basic-component-pipeline.yaml +++ b/.tekton/basic-component-pipeline.yaml @@ -170,6 +170,73 @@ spec: workspaces: - name: basic-auth workspace: git-auth + + - name: determine-version + params: + - name: SOURCE_ARTIFACT + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + runAfter: + - clone-repository + taskSpec: + params: + - name: SOURCE_ARTIFACT + type: string + - name: TRUSTED_ARTIFACT_IMAGE + type: string + default: "quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:9b180776a41d9a22a1c51539f1647c60defbbd55b44bbebdd4130e33512d8b0d" + - name: UBI_MINIMAL_IMAGE + type: string + default: "registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:2e8edce823a48e51858f1fad3ff4cbf6875ce8a3f86b9eecf298bc2050c8652a" + results: + - name: VERSION + description: Version string derived from git tags. + volumes: + - name: workdir + emptyDir: {} + stepTemplate: + volumeMounts: + - mountPath: /var/workdir + name: workdir + computeResources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 512Mi + steps: + - name: use-trusted-artifact + image: $(params.TRUSTED_ARTIFACT_IMAGE) + args: + - use + - $(params.SOURCE_ARTIFACT)=/var/workdir/source + - name: determine-version + image: $(params.UBI_MINIMAL_IMAGE) + workingDir: /var/workdir/source + script: | + #!/usr/bin/env bash + set -euo pipefail + microdnf install -y git-core + VERSION=$(git describe --tags --always) + echo "Determined version: ${VERSION}" >&2 + echo -n "${VERSION}" | tee "$(results.VERSION.path)" + + - name: generate-labels + params: + - name: label-templates + value: + - release=$ACTUAL_DATE_EPOCH + runAfter: + - clone-repository + taskRef: + params: + - name: name + value: generate-labels + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-generate-labels:0.1@sha256:d4ae1177fc2df0c07089bc30406ce75761cb7de21f361b254bf4dce8a5537e48 + - name: kind + value: task + resolver: bundles + - name: prefetch-dependencies params: - name: input @@ -223,6 +290,7 @@ spec: - name: BUILD_ARGS value: - $(params.build-args[*]) + - VERSION=$(tasks.determine-version.results.VERSION) - name: BUILD_ARGS_FILE value: $(params.build-args-file) - name: PRIVILEGED_NESTED @@ -232,7 +300,9 @@ spec: - name: BUILDAH_FORMAT value: $(params.buildah-format) - name: LABELS - value: ["$(params.extra-labels[*])"] + value: + - $(tasks.generate-labels.results.labels[*]) + - $(params.extra-labels[*]) - name: BUILD_TIMESTAMP value: "$(tasks.clone-repository.results.commit-timestamp)" - name: IMAGE_APPEND_PLATFORM @@ -488,6 +558,7 @@ spec: - name: BUILD_ARGS value: - $(params.build-args[*]) + - VERSION=$(tasks.determine-version.results.VERSION) - name: BUILD_ARGS_FILE value: $(params.build-args-file) - name: SOURCE_ARTIFACT diff --git a/konflux.Dockerfile b/konflux.Dockerfile index d6d34ae..2a9ddc0 100644 --- a/konflux.Dockerfile +++ b/konflux.Dockerfile @@ -58,6 +58,24 @@ RUN dnf install -y \ # Stage 4: Runtime - Minimal runtime image FROM ubi-micro-base +# Build arguments for labels +ARG VERSION=dev + +# Define labels +LABEL \ + com.redhat.component="agentic-cluster-security-suite-acs-mcp-server-container" \ + com.redhat.license_terms="https://www.redhat.com/agreements" \ + description="The ACS MCP Server" \ + io.k8s.description="The ACS MCP Server" \ + io.k8s.display-name="acs-mcp-server" \ + io.openshift.tags="acs-mcp-server" \ + maintainer="Red Hat, Inc." \ + name="agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9" \ + source-location="https://github.com/stackrox/stackrox-mcp" \ + summary="The ACS MCP Server" \ + version="${VERSION}" \ + release="1" + # Set default environment variables ENV LOG_LEVEL=INFO From 67654a9ac3a0c6de62090f713ba484922cf67db2 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Thu, 23 Jul 2026 14:59:47 +0200 Subject: [PATCH 2/2] Backport split main and release pipeline to remove image expire --- .tekton/acs-mcp-server-pull-request.yaml | 6 +- ...ush.yaml => acs-mcp-server-push-main.yaml} | 25 +++--- .tekton/acs-mcp-server-push-release.yaml | 85 +++++++++++++++++++ 3 files changed, 99 insertions(+), 17 deletions(-) rename .tekton/{acs-mcp-server-push.yaml => acs-mcp-server-push-main.yaml} (77%) create mode 100644 .tekton/acs-mcp-server-push-release.yaml diff --git a/.tekton/acs-mcp-server-pull-request.yaml b/.tekton/acs-mcp-server-pull-request.yaml index 86ef59a..7a6ff9a 100644 --- a/.tekton/acs-mcp-server-pull-request.yaml +++ b/.tekton/acs-mcp-server-pull-request.yaml @@ -18,8 +18,8 @@ metadata: target_branch == "main" || target_branch.startsWith("release-") || ( - has(body.pull_request) && - has(body.pull_request.labels) && + has(body.pull_request) && + has(body.pull_request.labels) && body.pull_request.labels.exists(l, l.name == "konflux-build") ) ) @@ -39,7 +39,7 @@ spec: - name: output-image-repo value: quay.io/redhat-user-workloads/agentic-cluster-security-suite-tenant/acs-mcp-server - name: image-expires-after - value: 5d + value: "5d" - name: dockerfile value: konflux.Dockerfile - name: hermetic diff --git a/.tekton/acs-mcp-server-push.yaml b/.tekton/acs-mcp-server-push-main.yaml similarity index 77% rename from .tekton/acs-mcp-server-push.yaml rename to .tekton/acs-mcp-server-push-main.yaml index 20be39e..2732b6a 100644 --- a/.tekton/acs-mcp-server-push.yaml +++ b/.tekton/acs-mcp-server-push-main.yaml @@ -9,30 +9,27 @@ metadata: pipelinesascode.tekton.dev/max-keep-runs: "10" pipelinesascode.tekton.dev/on-label: "[]" # For push trigger: - # - trigger on commit push on main or release branch. - # - trigger on tag pushes. + # - trigger on commit push on main. # For PR triggers: # - body.action != "ready_for_review" prevents double-triggering when a draft PR is marked ready for review. - # - trigger only for PRs on release branches. - # - support triggering by label: "konflux-build" + # - trigger only for PRs on main branch with label: "konflux-build" pipelinesascode.tekton.dev/on-cel-expression: | ( - event == "push" && target_branch.matches("^(main|release-.*|refs/tags/.*)$") + event == "push" && + target_branch.matches("^main$") ) || ( - event == "pull_request" && body.action != "ready_for_review" && ( - target_branch.startsWith("release-") || - ( - has(body.pull_request) && - has(body.pull_request.labels) && - body.pull_request.labels.exists(l, l.name == "konflux-build") - ) - ) + event == "pull_request" && + target_branch.matches("^main$") && + body.action != "ready_for_review" && + has(body.pull_request) && + has(body.pull_request.labels) && + body.pull_request.labels.exists(l, l.name == "konflux-build") ) labels: appstudio.openshift.io/application: agentic-cluster-security-suite appstudio.openshift.io/component: acs-mcp-server pipelines.appstudio.openshift.io/type: build - name: acs-mcp-server-on-push + name: acs-mcp-server-on-push-main namespace: agentic-cluster-security-suite-tenant spec: params: diff --git a/.tekton/acs-mcp-server-push-release.yaml b/.tekton/acs-mcp-server-push-release.yaml new file mode 100644 index 0000000..2c41bf3 --- /dev/null +++ b/.tekton/acs-mcp-server-push-release.yaml @@ -0,0 +1,85 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + annotations: + build.appstudio.openshift.io/repo: https://github.com/stackrox/stackrox-mcp?rev={{revision}} + build.appstudio.redhat.com/commit_sha: '{{revision}}' + build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' + build.appstudio.redhat.com/target_branch: '{{target_branch}}' + pipelinesascode.tekton.dev/max-keep-runs: "10" + pipelinesascode.tekton.dev/on-label: "[]" + # For push trigger: + # - trigger on commit push on release branches. + # - trigger on tag pushes. + # For PR triggers: + # - body.action != "ready_for_review" prevents double-triggering when a draft PR is marked ready for review. + # - trigger only for PRs on release branches with label: "konflux-build" + pipelinesascode.tekton.dev/on-cel-expression: | + ( + event == "push" && target_branch.matches("^(release-.*|refs/tags/.*)$") + ) || ( + event == "pull_request" && + target_branch.startsWith("release-") && + body.action != "ready_for_review" && + has(body.pull_request) && + has(body.pull_request.labels) && + body.pull_request.labels.exists(l, l.name == "konflux-build") + ) + labels: + appstudio.openshift.io/application: agentic-cluster-security-suite + appstudio.openshift.io/component: acs-mcp-server + pipelines.appstudio.openshift.io/type: build + name: acs-mcp-server-on-push-release + namespace: agentic-cluster-security-suite-tenant +spec: + params: + - name: git-url + value: '{{source_url}}' + - name: revision + value: '{{revision}}' + - name: output-image-repo + value: quay.io/redhat-user-workloads/agentic-cluster-security-suite-tenant/acs-mcp-server + - name: dockerfile + value: konflux.Dockerfile + - name: hermetic + value: 'true' + - name: prefetch-input + value: | + [ + { "type": "gomod", "path": "." }, + { "type": "rpm", "path": "." } + ] + - name: build-source-image + value: 'true' + - name: build-image-index + value: 'true' + - name: clone-depth + value: '0' + - name: clone-fetch-tags + value: 'true' + - name: build-platforms + value: + - linux/amd64 + - linux/arm64 + - linux/ppc64le + - linux/s390x + - name: extra-labels + value: + # X.Y in the cpe label must be adjusted for every version stream. + - "cpe=cpe:/a:redhat:agentic_cluster_security_suite:X.Y::el9" + + pipelineRef: + name: basic-component-pipeline + + taskRunTemplate: + serviceAccountName: build-pipeline-acs-mcp-server + + timeouts: + tasks: 1h + finally: 10m + pipeline: 1h10m + + workspaces: + - name: git-auth + secret: + secretName: '{{ git_auth_secret }}'