Add enterprise-contract pipeline definition to cli/pipelines#3435
Add enterprise-contract pipeline definition to cli/pipelines#3435jsmid1 wants to merge 1 commit into
Conversation
PR Summary by QodoAdd Enterprise Contract Tekton pipeline to cli catalog
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
|
🤖 Finished Review · ✅ Success · Started 1:09 PM UTC · Completed 1:27 PM UTC |
|
Warning Review limit reached
Next review available in: 43 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughChangesEnterprise contract pipeline
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code Review by Qodo
Context used✅ Compliance rules (platform):
27 rules 1. Stale v2 task comment
|
![qodo-for-conforma[bot]](https://avatars.githubusercontent.com/in/3609154?s=60&v=4){kind=small}
| # The purpose of this pipeline is to execute the verify-enterprise-contract-v2 task for container | ||
| # images that are built but not automatically released in order to provide early feedback to users. | ||
| # When auto release is enabled, the task is executed by the release pipeline immediately after the | ||
| # container images are built, thus it is not necessary to execute the task via this pipeline. |
There was a problem hiding this comment.
1. Stale v2 task comment 🐞 Bug ⚙ Maintainability
The pipeline header comment says it runs verify-enterprise-contract-v2, but the Pipeline actually resolves and runs verify-enterprise-contract, which can mislead maintainers and cause incorrect updates/debugging.
Agent Prompt
### Issue description
The pipeline header comment references `verify-enterprise-contract-v2`, but the pipeline taskRef resolves `verify-enterprise-contract`.
### Issue Context
This is a documentation mismatch that can confuse future maintenance (e.g., someone searching for “v2” or trying to bump the wrong task).
### Fix Focus Areas
- pipelines/enterprise-contract/0.1/enterprise-contract.yaml[1-4]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| metadata: | ||
| name: enterprise-contract | ||
| labels: | ||
| build.appstudio.redhat.com/pipeline: "enterprise-contract" |
There was a problem hiding this comment.
2. Missing pipeline catalog metadata 🐞 Bug ⚙ Maintainability
The enterprise-contract Pipeline lacks the standard Tekton metadata used on tasks in this repo (e.g., app.kubernetes.io/version and tekton.dev/displayName/tags/minVersion), reducing discoverability and consistency for publishing/consuming it as a versioned catalog artifact.
Agent Prompt
### Issue description
The pipeline is stored under a versioned directory (`pipelines/.../0.1/`) but its `metadata` does not include the common catalog metadata (version label and Tekton display/tags/minVersion annotations) that the repo’s tasks include.
### Issue Context
Tasks in `tasks/*/0.1/*.yaml` consistently set these fields; adding the same style to the pipeline improves consistency and downstream catalog UX.
### Fix Focus Areas
- pipelines/enterprise-contract/0.1/enterprise-contract.yaml[7-10]
- tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml[20-28]
- tasks/collect-keyless-params/0.1/collect-keyless-params.yaml[20-27]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| - name: POLICY_CONFIGURATION | ||
| type: string | ||
| description: | | ||
| Name of the policy configuration (EnterpriseContractConfiguration | ||
| object) to use. `namespace/name` or `name` syntax supported. If | ||
| namespace is omitted the namespace where the task runs is used. | ||
| default: enterprise-contract-service/default | ||
| - name: SSL_CERT_DIR |
There was a problem hiding this comment.
3. Misleading param descriptions 🐞 Bug ⚙ Maintainability
Pipeline param documentation diverges from the underlying verify-enterprise-contract task (e.g., POLICY_CONFIGURATION is described as an EnterpriseContractConfiguration object, while the task describes an EnterpriseContractPolicy resource), increasing the risk of misconfiguration by pipeline consumers.
Agent Prompt
### Issue description
The Pipeline’s parameter descriptions are not consistent with the task it invokes, which can mislead users configuring the Pipeline.
### Issue Context
`POLICY_CONFIGURATION` is passed directly into the `verify-enterprise-contract` task, so the Pipeline should document the same semantics/value format as the task.
### Fix Focus Areas
- pipelines/enterprise-contract/0.1/enterprise-contract.yaml[26-33]
- pipelines/enterprise-contract/0.1/enterprise-contract.yaml[70-73]
- tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml[49-57]
- tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml[198-210]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pipelines/enterprise-contract/0.1/enterprise-contract.yaml`:
- Around line 1-8: Add the repository-standard license header at the very
beginning of the enterprise-contract Pipeline YAML, before the existing purpose
comments and apiVersion declaration. Match the exact header convention used by
neighboring files under pipelines/ and tasks/.
- Around line 92-131: Update the verify task parameters to pass the
collect-keyless-params buildIdentityRegexp result as
CERTIFICATE_IDENTITY_REGEXP. Keep the existing CERTIFICATE_IDENTITY mapping to
tektonChainsIdentity unchanged, so verify receives both exact and regex-based
keyless identity configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 288f9467-ccdf-4bb2-8b79-6ba6845ff769
📒 Files selected for processing (1)
pipelines/enterprise-contract/0.1/enterprise-contract.yaml
| - name: collect-keyless-params | ||
| taskRef: | ||
| resolver: bundles | ||
| params: | ||
| - name: bundle | ||
| value: quay.io/conforma/tekton-task:konflux | ||
| - name: name | ||
| value: collect-keyless-params | ||
| - name: kind | ||
| value: task | ||
| - name: verify | ||
| runAfter: | ||
| - collect-keyless-params | ||
| params: | ||
| - name: POLICY_CONFIGURATION | ||
| value: "$(params.POLICY_CONFIGURATION)" | ||
| - name: IMAGES | ||
| value: "$(params.SNAPSHOT)" | ||
| - name: SSL_CERT_DIR | ||
| value: "$(params.SSL_CERT_DIR)" | ||
| - name: STRICT | ||
| value: "$(params.STRICT)" | ||
|
|
||
| - name: PUBLIC_KEY | ||
| # PUBLIC_KEY will be ignored if any of the CERTIFICATE_* params are present | ||
| value: "$(params.PUBLIC_KEY)" | ||
| - name: IGNORE_REKOR | ||
| # Set this true because Chains in default Konflux does not create Rekor entries | ||
| # when signing things. It will be ignored if any of the CERTIFICATE_* params | ||
| # because keyless verification does require Rekor. | ||
| value: "true" | ||
|
|
||
| - name: CERTIFICATE_OIDC_ISSUER | ||
| value: "$(tasks.collect-keyless-params.results.defaultOIDCIssuer)" | ||
| - name: CERTIFICATE_IDENTITY | ||
| value: "$(tasks.collect-keyless-params.results.tektonChainsIdentity)" | ||
| - name: TUF_MIRROR | ||
| value: "$(tasks.collect-keyless-params.results.tufUrl)" | ||
| - name: REKOR_HOST | ||
| value: "$(tasks.collect-keyless-params.results.rekorUrl)" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -n 'CERTIFICATE_IDENTITY_REGEXP|buildIdentityRegexp' -g '*.yaml'Repository: conforma/cli
Length of output: 150
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file existence and relevant snippets =="
if [ -f pipelines/enterprise-contract/0.1/enterprise-contract.yaml ]; then
nl -ba pipelines/enterprise-contract/0.1/enterprise-contract.yaml | sed -n '1,180p'
else
echo "missing pipelines/enterprise-contract/0.1/enterprise-contract.yaml"
fi
echo
echo "== tracked yaml files mentioning relevant params/results =="
rg -n 'collect-keyless-params|buildIdentityRegexp|CERTIFICATE_IDENTITY_REGEXP|tektonChainsIdentity|defaultOIDCIssuer' -g '*.yaml' || true
echo
echo "== repository-wide occurrences =="
rg -n 'collect-keyless-params|buildIdentityRegexp|CERTIFICATE_IDENTITY_REGEXP|tektonChainsIdentity|defaultOIDCIssuer' || trueRepository: conforma/cli
Length of output: 233
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file existence =="
test -f pipelines/enterprise-contract/0.1/enterprise-contract.yaml && echo "present" || echo "missing"
test -d pipelines/enterprise-contract/0.1 && echo "dir present" || echo "dir missing"
find pipelines -maxdepth 3 -type f 2>/dev/null || true
echo
echo "== relevant snippets using cat -n =="
if [ -f pipelines/enterprise-contract/0.1/enterprise-contract.yaml ]; then
cat -n pipelines/enterprise-contract/0.1/enterprise-contract.yaml | sed -n '1,180p'
fi
echo
echo "== tracked yaml files mentioning relevant params/results =="
rg -n 'collect-keyless-params|buildIdentityRegexp|CERTIFICATE_IDENTITY_REGEXP|tektonChainsIdentity|defaultOIDCIssuer' -g '*.yaml' . || true
echo
echo "== repository-wide occurrences =="
rg -n 'collect-keyless-params|buildIdentityRegexp|CERTIFICATE_IDENTITY_REGEXP|tektonChainsIdentity|defaultOIDCIssuer' . || trueRepository: conforma/cli
Length of output: 25892
Wire collect-keyless-params.buildIdentityRegexp into verify.
collect-keyless-params reads and emits buildIdentityRegexp, and verify-enterprise-contract supports CERTIFICATE_IDENTITY_REGEXP for regex-based keyless identity matching, but this pipeline only passes tektonChainsIdentity as CERTIFICATE_IDENTITY. Clusters/configs that rely on the regex identity are using an exact match instead.
Proposed fix
- name: CERTIFICATE_IDENTITY
value: "$(tasks.collect-keyless-params.results.tektonChainsIdentity)"
+ - name: CERTIFICATE_IDENTITY_REGEXP
+ value: "$(tasks.collect-keyless-params.results.buildIdentityRegexp)"
- name: TUF_MIRROR
value: "$(tasks.collect-keyless-params.results.tufUrl)"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: collect-keyless-params | |
| taskRef: | |
| resolver: bundles | |
| params: | |
| - name: bundle | |
| value: quay.io/conforma/tekton-task:konflux | |
| - name: name | |
| value: collect-keyless-params | |
| - name: kind | |
| value: task | |
| - name: verify | |
| runAfter: | |
| - collect-keyless-params | |
| params: | |
| - name: POLICY_CONFIGURATION | |
| value: "$(params.POLICY_CONFIGURATION)" | |
| - name: IMAGES | |
| value: "$(params.SNAPSHOT)" | |
| - name: SSL_CERT_DIR | |
| value: "$(params.SSL_CERT_DIR)" | |
| - name: STRICT | |
| value: "$(params.STRICT)" | |
| - name: PUBLIC_KEY | |
| # PUBLIC_KEY will be ignored if any of the CERTIFICATE_* params are present | |
| value: "$(params.PUBLIC_KEY)" | |
| - name: IGNORE_REKOR | |
| # Set this true because Chains in default Konflux does not create Rekor entries | |
| # when signing things. It will be ignored if any of the CERTIFICATE_* params | |
| # because keyless verification does require Rekor. | |
| value: "true" | |
| - name: CERTIFICATE_OIDC_ISSUER | |
| value: "$(tasks.collect-keyless-params.results.defaultOIDCIssuer)" | |
| - name: CERTIFICATE_IDENTITY | |
| value: "$(tasks.collect-keyless-params.results.tektonChainsIdentity)" | |
| - name: TUF_MIRROR | |
| value: "$(tasks.collect-keyless-params.results.tufUrl)" | |
| - name: REKOR_HOST | |
| value: "$(tasks.collect-keyless-params.results.rekorUrl)" | |
| - name: collect-keyless-params | |
| taskRef: | |
| resolver: bundles | |
| params: | |
| - name: bundle | |
| value: quay.io/conforma/tekton-task:konflux | |
| - name: name | |
| value: collect-keyless-params | |
| - name: kind | |
| value: task | |
| - name: verify | |
| runAfter: | |
| - collect-keyless-params | |
| params: | |
| - name: POLICY_CONFIGURATION | |
| value: "$(params.POLICY_CONFIGURATION)" | |
| - name: IMAGES | |
| value: "$(params.SNAPSHOT)" | |
| - name: SSL_CERT_DIR | |
| value: "$(params.SSL_CERT_DIR)" | |
| - name: STRICT | |
| value: "$(params.STRICT)" | |
| - name: PUBLIC_KEY | |
| # PUBLIC_KEY will be ignored if any of the CERTIFICATE_* params are present | |
| value: "$(params.PUBLIC_KEY)" | |
| - name: IGNORE_REKOR | |
| # Set this true because Chains in default Konflux does not create Rekor entries | |
| # when signing things. It will be ignored if any of the CERTIFICATE_* params | |
| # because keyless verification does require Rekor. | |
| value: "true" | |
| - name: CERTIFICATE_OIDC_ISSUER | |
| value: "$(tasks.collect-keyless-params.results.defaultOIDCIssuer)" | |
| - name: CERTIFICATE_IDENTITY | |
| value: "$(tasks.collect-keyless-params.results.tektonChainsIdentity)" | |
| - name: CERTIFICATE_IDENTITY_REGEXP | |
| value: "$(tasks.collect-keyless-params.results.buildIdentityRegexp)" | |
| - name: TUF_MIRROR | |
| value: "$(tasks.collect-keyless-params.results.tufUrl)" | |
| - name: REKOR_HOST | |
| value: "$(tasks.collect-keyless-params.results.rekorUrl)" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pipelines/enterprise-contract/0.1/enterprise-contract.yaml` around lines 92 -
131, Update the verify task parameters to pass the collect-keyless-params
buildIdentityRegexp result as CERTIFICATE_IDENTITY_REGEXP. Keep the existing
CERTIFICATE_IDENTITY mapping to tektonChainsIdentity unchanged, so verify
receives both exact and regex-based keyless identity configuration.
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
ReviewFindingsHigh
Low
Labels: PR adds a Tekton Pipeline definition for CI verification workflows Previous runReviewFindingsMedium
Low
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
the
requires-manual-review
Move the enterprise-contract integration pipeline source of truth from build-definitions to cli/pipelines/, consistent with how task definitions are already maintained in cli/tasks/. This enables publishing to conforma/tekton-catalog alongside existing tasks. Ref: https://issues.redhat.com/browse/EC-1942
|
🤖 Finished Review · ✅ Success · Started 1:31 PM UTC · Completed 1:48 PM UTC |
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| # The purpose of this pipeline is to execute the verify-enterprise-contract-v2 task for container | ||
| # images that are built but not automatically released in order to provide early feedback to users. |
There was a problem hiding this comment.
[low] stale-reference
The comment states 'execute the verify-enterprise-contract-v2 task' but the pipeline's taskRef references 'verify-enterprise-contract' (without '-v2'). No task named 'verify-enterprise-contract-v2' exists in the repository.
Suggested fix: Change the comment to reference 'verify-enterprise-contract' instead of 'verify-enterprise-contract-v2'.
| Each "containerImage" in the "components" array is validated. | ||
| - name: POLICY_CONFIGURATION | ||
| type: string | ||
| description: | |
There was a problem hiding this comment.
[low] api-contract
The POLICY_CONFIGURATION description refers to 'EnterpriseContractConfiguration object' but the correct type name is 'EnterpriseContractPolicy', used consistently throughout the codebase and in the downstream task's own description.
Suggested fix: Change 'EnterpriseContractConfiguration' to 'EnterpriseContractPolicy'.
| @@ -0,0 +1,172 @@ | |||
| # Copyright The Conforma Contributors | |||
There was a problem hiding this comment.
[low] document-format
Missing YAML document separator ('---') at the top of the file. All existing Tekton resource files in tasks/ start with '---' before the copyright header.
Suggested fix: Add '---' as the first line of the file, before the copyright comment.
| kind: Pipeline | ||
| metadata: | ||
| name: enterprise-contract | ||
| labels: |
There was a problem hiding this comment.
[low] metadata-consistency
The pipeline metadata lacks annotations (tekton.dev/displayName, tekton.dev/pipelines.minVersion, tekton.dev/tags) and the app.kubernetes.io/version label that all task definitions in this repo include.
fullsend-ai-review
Bot
added
ci
and removed
requires-manual-review
1 participant
Move the enterprise-contract integration pipeline source of truth from build-definitions to cli/pipelines/, consistent with how task definitions are already maintained in cli/tasks/. This enables publishing to conforma/tekton-catalog alongside existing tasks.
Ref: https://issues.redhat.com/browse/EC-1942