|
| 1 | +apiVersion: tekton.dev/v1beta1 |
| 2 | +kind: Task |
| 3 | +metadata: |
| 4 | + name: sealights-go-instrumentation |
| 5 | + labels: |
| 6 | + konflux-ci/sealights: "true" |
| 7 | + konflux-ci/sealights-language: "go" |
| 8 | +spec: |
| 9 | + description: >- |
| 10 | + This Tekton task automates the process of instrumenting Go code with Sealights for quality analytics and testing. |
| 11 | + It retrieves the source code from a trusted artifact, instruments the code with Sealights, and then creates |
| 12 | + a new trusted artifact with the instrumented code. The task can be triggered by either Pull Request or other events. |
| 13 | + results: |
| 14 | + - name: sealights-bsid |
| 15 | + type: string |
| 16 | + description: "A unique identifier generated for the current sealights build session." |
| 17 | + - name: sealights-build-name |
| 18 | + type: string |
| 19 | + description: "A unique build name generated using the commit SHA and current date to prevent conflicts during test reruns." |
| 20 | + - name: source-artifact |
| 21 | + description: The Trusted Artifact URI pointing to the artifact with |
| 22 | + the application source code. |
| 23 | + type: string |
| 24 | + params: |
| 25 | + - name: source-artifact |
| 26 | + description: The Trusted Artifact URI pointing to the artifact with |
| 27 | + the application source code. |
| 28 | + type: string |
| 29 | + - name: go-version |
| 30 | + type: string |
| 31 | + description: >- |
| 32 | + "The Go version to use with the 'ubi8/go-toolset' image, in the format '1.x.y' (e.g., '1.21.3'). The go version should be |
| 33 | + compatible with tags from the Red Hat catalog: https://catalog.redhat.com/software/containers/ubi8/go-toolset/5ce8713aac3db925c03774d1" |
| 34 | + - name: sealights-secret |
| 35 | + type: string |
| 36 | + description: >- |
| 37 | + "The name of the Openshift secret containing Sealights credentials. The credentials will expect to have us key secret the token. More information |
| 38 | + on how to obtain the Sealights token credentials can be found at https://sealights.atlassian.net/wiki/spaces/SUP/pages/25591812/Generating+a+token." |
| 39 | + - name: component |
| 40 | + type: string |
| 41 | + description: "The name of the Konflux component associated with the integration tests." |
| 42 | + - name: scm-provider |
| 43 | + type: string |
| 44 | + default: "github" |
| 45 | + description: "The source control management (SCM) provider used for the project, such as 'github', 'gitlab'." |
| 46 | + - name: packages-excluded |
| 47 | + type: array |
| 48 | + default: [] |
| 49 | + description: "A list of Go packages to exclude from Sealights instrumentation during the code scan. Specify package paths to prevent them from being analyzed (e.g., 'pkg1', 'github.com/modern-go/concurrent')." |
| 50 | + - name: repository-url |
| 51 | + type: string |
| 52 | + description: "The name or URL of the source code repository (e.g., 'github.com/org/repo')." |
| 53 | + default: "" |
| 54 | + - name: branch |
| 55 | + type: string |
| 56 | + description: "The name of the Git branch to use for the operation (e.g., 'main' or 'feature-branch')." |
| 57 | + default: "main" |
| 58 | + - name: revision |
| 59 | + type: string |
| 60 | + description: "The Git revision (commit SHA) from which the test pipeline is originating." |
| 61 | + - name: pull-request-number |
| 62 | + type: string |
| 63 | + description: "The identifier number of the pull request/merge request." |
| 64 | + default: "" |
| 65 | + - name: target-branch |
| 66 | + type: string |
| 67 | + description: "The name of the target branch for the pull request, typically the branch into which the changes will be merged (e.g., 'main', 'develop')." |
| 68 | + default: "main" |
| 69 | + - name: oci-storage |
| 70 | + description: The OCI repository where the Trusted Artifacts are stored. |
| 71 | + type: string |
| 72 | + volumes: |
| 73 | + - name: sealights-credentials |
| 74 | + secret: |
| 75 | + secretName: sealights-credentials |
| 76 | + - name: workdir |
| 77 | + emptyDir: {} |
| 78 | + stepTemplate: |
| 79 | + volumeMounts: |
| 80 | + - mountPath: /var/workdir |
| 81 | + name: workdir |
| 82 | + - name: sealights-credentials |
| 83 | + mountPath: /usr/local/sealights-credentials |
| 84 | + steps: |
| 85 | + - name: use-trusted-artifact |
| 86 | + image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:52f1391e6f1c472fd10bb838f64fae2ed3320c636f536014978a5ddbdfc6b3af |
| 87 | + args: |
| 88 | + - use |
| 89 | + - $(params.source-artifact)=/var/workdir/source |
| 90 | + - name: sealights-go-instrumentation |
| 91 | + image: registry.access.redhat.com/ubi8/go-toolset:$(params.go-version) |
| 92 | + workingDir: /var/workdir/source |
| 93 | + securityContext: |
| 94 | + runAsUser: 0 |
| 95 | + env: |
| 96 | + - name: COMPONENT |
| 97 | + value: $(params.component) |
| 98 | + - name: SCM_PROVIDER |
| 99 | + value: $(params.scm-provider) |
| 100 | + - name: REPOSITORY_URL |
| 101 | + value: $(params.repository-url) |
| 102 | + - name: BRANCH |
| 103 | + value: $(params.branch) |
| 104 | + - name: REVISION |
| 105 | + value: $(params.revision) |
| 106 | + - name: PULL_REQUEST_NUMBER |
| 107 | + value: $(params.pull-request-number) |
| 108 | + - name: TARGET_BRANCH |
| 109 | + value: $(params.target-branch) |
| 110 | + - name: TEST_EVENT |
| 111 | + valueFrom: |
| 112 | + fieldRef: |
| 113 | + fieldPath: metadata.labels['pipelinesascode.tekton.dev/event-type'] |
| 114 | + args: ["$(params.packages-excluded[*])"] |
| 115 | + script: | |
| 116 | + #!/bin/bash |
| 117 | + set -euo pipefail |
| 118 | +
|
| 119 | + export SEALIGHTS_TOKEN BUILD_NAME BSID PACKAGES_EXCLUDED_ENUM |
| 120 | +
|
| 121 | + SEALIGHTS_TOKEN="$(cat /usr/local/sealights-credentials/token)" |
| 122 | + BUILD_NAME="${REVISION}_$(date +'%y%m%d.%H%M')" |
| 123 | + PACKAGES_EXCLUDED_ENUM="$(IFS=,; echo "$(printf "%s," "$@" | sed 's/,$//')")" |
| 124 | +
|
| 125 | + wget -qO- https://agents.sealights.co/slgoagent/latest/slgoagent-linux-amd64.tar.gz | tar -xzv -C /usr/local/bin |
| 126 | + wget -qO- https://agents.sealights.co/slcli/latest/slcli-linux-amd64.tar.gz | tar -xzv -C /usr/local/bin |
| 127 | +
|
| 128 | + slcli config init --lang go --token "${SEALIGHTS_TOKEN}" |
| 129 | +
|
| 130 | + # In case is coming from /retest event then it's a pull_request |
| 131 | + # if event type is not push and pull_request_number is not empty then is a pull_request |
| 132 | + echo "[INFO] Tekton Event Type received: ${TEST_EVENT}" |
| 133 | + if [ "$TEST_EVENT" != "push" ] && [ -n "$PULL_REQUEST_NUMBER" ]; then |
| 134 | + TEST_EVENT="pull_request" |
| 135 | + fi |
| 136 | +
|
| 137 | + if [ -n "${TEST_EVENT}" ] && [ "${TEST_EVENT}" = "pull_request" ]; then |
| 138 | + echo "[INFO] Creating build session id from a ${TEST_EVENT} event source code: [ component: ${COMPONENT}, target-branch: ${TARGET_BRANCH}, pull-request-number ${PULL_REQUEST_NUMBER}, latest-commit: ${REVISION} ]" |
| 139 | + slcli config create-pr-bsid --app "${COMPONENT}" --target-branch "${TARGET_BRANCH}" \ |
| 140 | + --pull-request-number "${PULL_REQUEST_NUMBER}" --latest-commit "${REVISION}" --repository-url "${REPOSITORY_URL}" |
| 141 | + else |
| 142 | + echo "[INFO] Creating build session ID (BSID) ${TEST_EVENT} event source code [ component: ${COMPONENT}, branch: ${BRANCH}, build: ${BUILD_NAME} ]" |
| 143 | + slcli config create-bsid --app "${COMPONENT}" --branch "${BRANCH}" --build "${BUILD_NAME}" |
| 144 | + fi |
| 145 | +
|
| 146 | + slcli scan --packages-excluded "${PACKAGES_EXCLUDED_ENUM}" --bsid buildSessionId.txt --path-to-scanner /usr/local/bin/slgoagent \ |
| 147 | + --workspacepath ./ --scm git --scmProvider "${SCM_PROVIDER}" --scmVersion "0" --scmBaseUrl "${REPOSITORY_URL}" |
| 148 | +
|
| 149 | + echo -n "$(cat buildSessionId.txt)" > $(results.sealights-bsid.path) |
| 150 | + echo -n "$BUILD_NAME" > $(results.sealights-build-name.path) |
| 151 | +
|
| 152 | + # Temporary solution. Remove tokens to not build them |
| 153 | + rm -rf build.json slcmd_config.json |
| 154 | + - name: create-trusted-artifact |
| 155 | + image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:52f1391e6f1c472fd10bb838f64fae2ed3320c636f536014978a5ddbdfc6b3af |
| 156 | + args: |
| 157 | + - create |
| 158 | + - --store |
| 159 | + - $(params.oci-storage) |
| 160 | + - $(results.source-artifact.path)=/var/workdir/source |
0 commit comments