Merge branch 'main' into integration_quay_reorg

.github/workflows/check-task-owners.yaml

@@ -13,3 +13,22 @@ jobs:
       - name: Check task owners
         run: |
           ./hack/check-task-owners.sh
+
+      - name: Check renovate.json groups
+        run: |
+          #!/bin/bash
+          set -euo pipefail
+
+          renovate_content=$(cat renovate.json)
+          ./hack/update_renovate_json_based_on_codeowners.py -o renovate.json
+
+          uptodate=$(jq --argjson previous "$renovate_content" '$previous == .' renovate.json)
+          echo "renovate.json is up to date: $uptodate"
+
+          if [[ $uptodate == false ]]; then
+              echo
+              git --no-pager diff -- renovate.json
+              echo
+              echo "To apply the updates, run: ./hack/update_renovate_json_based_on_codeowners.py -o renovate.json"
+              exit 1
+          fi

.github/workflows/go-ci.yaml

@@ -18,7 +18,7 @@ jobs:
           go-version-file: './${{matrix.path}}/go.mod'
           cache-dependency-path: ./${{matrix.path}}/go.sum
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@9e66d46e22c9991dbf33ddab82b6b28b69052dec
+        uses: golangci/golangci-lint-action@0e1fd32b0c0584f0d28eec08848dfd2bf6a909d9
         with:
           working-directory: ${{matrix.path}}
           args: "--timeout=10m --build-tags='normal periodic'"
@@ -84,7 +84,7 @@ jobs:
           # we let the report trigger content trigger a failure using the GitHub Security features.
           args: '-tags normal,periodic -no-fail -fmt sarif -out results.sarif ${{matrix.path}}/...'
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@978ed829bdde7389737ac17d6b144aeed5f9bdad
+        uses: github/codeql-action/upload-sarif@6f9e628e6f9a18c785dd746325ba455111df1b67
         with:
           # Path to SARIF file relative to the root of the repository
           sarif_file: results.sarif

.github/workflows/run-task-tests.yaml

@@ -9,84 +9,105 @@ name: Run Task Tests
 
 jobs:
   run-task-tests:
-    runs-on: ubuntu-22.04
-    # Skipping it temporarily till we fix this workflow
-    if: false
+    runs-on: ubuntu-24.04
     steps:
       - name: Get all changed files in the PR from task directory
         id: changed-dirs
         uses: tj-actions/changed-files@v45
         with:
           files: |
-            task/**
+            # Any task yaml or script (including its tests) is changed
+            task/**/*.{yaml,sh}
           dir_names: "true"
           dir_names_max_depth: "3"
 
       - name: Checkout build-defintions Repository
         if: steps.changed-dirs.outputs.any_changed == 'true'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: "${{ github.event.pull_request.head.sha }}"
           path: build-definitions
 
-      - name: Install tkn
+      - name: Check if tests dir exists for all the tasks changed
         if: steps.changed-dirs.outputs.any_changed == 'true'
+        id: tasks-to-be-tested
+        env:
+          CHANGED_DIRS: ${{ steps.changed-dirs.outputs.all_changed_files }}
+        run: |
+          echo "Task Dirs changed in PR: ${CHANGED_DIRS}"
+          # Check if tests dir exists under each task dir
+          TASKS_TO_BE_TESTED=()
+          for TASK_DIR in ${CHANGED_DIRS}; do
+            TESTS_DIR=build-definitions/${TASK_DIR}/tests
+            if [ ! -d $TESTS_DIR ]; then
+              echo "INFO: tests dir does not exist: $TESTS_DIR"
+              continue
+            else
+              echo "INFO: tests dir exists for task: $TASK_DIR"
+              TASKS_TO_BE_TESTED+=("$TASK_DIR")
+            fi
+          done
+          echo "Tasks with tests: ${TASKS_TO_BE_TESTED[*]}"
+          echo "tasklist=${TASKS_TO_BE_TESTED[*]}" >> $GITHUB_OUTPUT
+
+      - name: Install tkn
+        if: steps.tasks-to-be-tested.outputs.tasklist != ''
         uses: ./build-definitions/.github/actions/install-tkn
 
       - name: Checkout konflux-ci/konflux-ci Repository
-        if: steps.changed-dirs.outputs.any_changed == 'true'
-        uses: actions/checkout@v3
+        if: steps.tasks-to-be-tested.outputs.tasklist != ''
+        uses: actions/checkout@v4
         with:
           repository: 'konflux-ci/konflux-ci'
           path: konflux-ci
-          ref: c4630e684e81f71bfd920fff0c9bb2956d3265f4
+          ref: 13c9f7f0f90d615249c8d4d67a18c919b7bb3d95
 
       - name: Create k8s Kind Cluster
-        if: steps.changed-dirs.outputs.any_changed == 'true'
+        if: steps.tasks-to-be-tested.outputs.tasklist != ''
         uses: helm/kind-action@v1
         with:
           config: konflux-ci/kind-config.yaml
 
       - name: Show version information
-        if: steps.changed-dirs.outputs.any_changed == 'true'
+        if: steps.tasks-to-be-tested.outputs.tasklist != ''
         run: |
           kubectl version
           kind version
 
       - name: Deploying Dependencies
-        if: steps.changed-dirs.outputs.any_changed == 'true'
+        if: steps.tasks-to-be-tested.outputs.tasklist != ''
         run: |
           cd $GITHUB_WORKSPACE/konflux-ci
           ./deploy-deps.sh
 
       - name: Wait for the dependencies to be ready
-        if: steps.changed-dirs.outputs.any_changed == 'true'
+        if: steps.tasks-to-be-tested.outputs.tasklist != ''
         run: |
           cd $GITHUB_WORKSPACE/konflux-ci
           ./wait-for-all.sh
 
       - name: Deploying Konflux
-        if: steps.changed-dirs.outputs.any_changed == 'true'
+        if: steps.tasks-to-be-tested.outputs.tasklist != ''
         run: |
           cd $GITHUB_WORKSPACE/konflux-ci
           ./deploy-konflux.sh
 
       - name: List namespaces
-        if: steps.changed-dirs.outputs.any_changed == 'true'
+        if: steps.tasks-to-be-tested.outputs.tasklist != ''
         run: |
           kubectl get namespace
 
       - name: Deploy test resources
-        if: steps.changed-dirs.outputs.any_changed == 'true'
+        if: steps.tasks-to-be-tested.outputs.tasklist != ''
         run: |
           cd $GITHUB_WORKSPACE/konflux-ci
           ./deploy-test-resources.sh
 
       - name: Run the task tests
-        if: steps.changed-dirs.outputs.any_changed == 'true'
+        if: steps.tasks-to-be-tested.outputs.tasklist != ''
         env:
-          CHANGED_DIRS: ${{ steps.changed-dirs.outputs.all_changed_files }}
+          TASK_LIST: ${{ steps.tasks-to-be-tested.outputs.tasklist }}
         run: |
-          echo "Task Dirs changed in PR: ${CHANGED_DIRS}"
+          echo "Tasks to be tested: ${TASK_LIST}"
           cd $GITHUB_WORKSPACE/build-definitions
-          ./.github/scripts/test_tekton_tasks.sh ${CHANGED_DIRS}
+          ./.github/scripts/test_tekton_tasks.sh ${TASK_LIST}

.tekton/pull-request.yaml

@@ -36,6 +36,27 @@ spec:
             value: $(params.revision)
           - name: depth
             value: "0"
+      - name: build-appstudio-utils
+        runAfter:
+          - fetch-repository
+        params:
+          - name: IMAGE
+            value: quay.io/konflux-ci/pull-request-builds:appstudio-utils-{{revision}}
+          - name: CONTEXT
+            value: appstudio-utils
+        taskRef:
+          name: buildah
+        workspaces:
+          - name: source
+            workspace: workspace
+      - name: sast-snyk-check
+        runAfter:
+          - fetch-repository
+        taskRef:
+          name: sast-snyk-check
+        workspaces:
+          - name: workspace
+            workspace: workspace
       - name: task-switchboard
         taskRef:
           name: task-switchboard
@@ -48,7 +69,12 @@ spec:
             value:
               - tasks := strings.any_prefix_match(input, ["task/", "hack/", ".tekton/"])
               - tasks_pipelines := strings.any_prefix_match(input, ["task/", "pipelines/", "hack/", ".tekton/"])
-              - e2e_tests := strings.any_prefix_match(input, ["task/", "pipelines/", "hack/", ".tekton/"])
+              - |
+                e2e_tests if {
+                  some file in input
+                  strings.any_prefix_match(file, ["task/", "pipelines/", "hack/", ".tekton/"])
+                  not endswith(file, "/OWNERS")
+                }
               - check_partner_tasks := strings.any_prefix_match(input, ["partners/", "hack/", ".tekton/"])
         runAfter:
           - build-appstudio-utils
@@ -58,20 +84,12 @@ spec:
             operator: "in"
             values: ["$(tasks.task-switchboard.results.bindings[*])"]
         runAfter:
-          - fetch-repository
+          - task-switchboard
         taskRef:
           name: task-lint
         workspaces:
           - name: shared-workspace
             workspace: workspace
-      - name: sast-snyk-check
-        runAfter:
-          - fetch-repository
-        taskRef:
-          name: sast-snyk-check
-        workspaces:
-          - name: workspace
-            workspace: workspace
       - name: sast-unicode-check
         runAfter:
           - build-appstudio-utils
@@ -80,26 +98,13 @@ spec:
         workspaces:
           - name: workspace
             workspace: workspace
-      - name: build-appstudio-utils
-        runAfter:
-          - fetch-repository
-        params:
-          - name: IMAGE
-            value: quay.io/konflux-ci/pull-request-builds:appstudio-utils-{{revision}}
-          - name: CONTEXT
-            value: appstudio-utils
-        taskRef:
-          name: buildah
-        workspaces:
-          - name: source
-            workspace: workspace
       - name: check-partner-tasks
         when:
           - input: "check_partner_tasks"
             operator: "in"
             values: ["$(tasks.task-switchboard.results.bindings[*])"]
         runAfter:
-          - build-appstudio-utils
+          - task-switchboard
         taskSpec:
           steps:
             - name: check-task-structure
@@ -153,6 +158,8 @@ spec:
           - input: "tasks_pipelines"
             operator: "in"
             values: ["$(tasks.task-switchboard.results.bindings[*])"]
+        runAfter:
+          - task-switchboard
         params:
           - name: revision
             value: "{{ revision }}"
@@ -227,33 +234,13 @@ spec:
           name: e2e-test
         # Added a timeout due to https://issues.redhat.com/browse/STONEBLD-2265
         timeout: "2h"
-      - name: check-task-pipeline-repo-existence
-        when:
-          - input: "tasks_pipelines"
-            operator: "in"
-            values: ["$(tasks.task-switchboard.results.bindings[*])"]
-        runAfter:
-          - build-bundles
-        taskSpec:
-          steps:
-            - name: fail-when-repo-is-missed
-              image: quay.io/konflux-ci/pull-request-builds:appstudio-utils-{{revision}}
-              workingDir: $(workspaces.source.path)/source
-              script: |
-                #!/usr/bin/env bash
-                .tekton/scripts/check-task-pipeline-bundle-repos.sh
-          workspaces:
-            - name: source
-        workspaces:
-          - name: source
-            workspace: workspace
       - name: ec-task-checks
         when:
           - input: "tasks_pipelines"
             operator: "in"
             values: ["$(tasks.task-switchboard.results.bindings[*])"]
         runAfter:
-          - fetch-repository
+          - task-switchboard
         taskRef:
           name: ec-checks
         workspaces:
@@ -265,7 +252,7 @@ spec:
             operator: "in"
             values: ["$(tasks.task-switchboard.results.bindings[*])"]
         runAfter:
-          - fetch-repository
+          - task-switchboard
         taskSpec:
           steps:
             - name: check-task-migration-md

.tekton/push.yaml

@@ -176,6 +176,29 @@ spec:
           workspaces:
             - name: source
 
+      - name: create-repositories-if-missing
+        runAfter:
+          - build-bundles
+        taskSpec:
+          steps:
+            - name: run-create-bundle-repos
+              image: quay.io/konflux-ci/pull-request-builds:appstudio-utils-{{revision}}
+              workingDir: $(workspaces.source.path)/source
+              script: |
+                #!/usr/bin/env bash
+                .tekton/scripts/create-task-pipeline-bundle-repos.sh
+              env:
+                - name: QUAY_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: konflux-ci-repo-creator
+                      key: quaytoken
+          workspaces:
+            - name: source
+        workspaces:
+          - name: source
+            workspace: workspace
+
       - name: update-infra-repo
         runAfter:
           - build-bundles