ROX-34386: Add image labels #162
+66
−0
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -158,6 +158,44 @@ spec: | |
| workspaces: | ||
| - name: basic-auth | ||
| workspace: git-auth | ||
|
|
||
| - name: determine-version | ||
| params: | ||
| - name: SOURCE_ARTIFACT | ||
| value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) | ||
| runAfter: | ||
| - clone-repository | ||
| taskSpec: | ||
| params: | ||
| - name: SOURCE_ARTIFACT | ||
| type: string | ||
| results: | ||
| - name: VERSION | ||
| description: Version string derived from git tags. | ||
| volumes: | ||
| - name: workdir | ||
| emptyDir: {} | ||
| stepTemplate: | ||
| volumeMounts: | ||
| - mountPath: /var/workdir | ||
| name: workdir | ||
| steps: | ||
| - name: use-trusted-artifact | ||
| image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:9b180776a41d9a22a1c51539f1647c60defbbd55b44bbebdd4130e33512d8b0d | ||
| args: | ||
| - use | ||
| - $(params.SOURCE_ARTIFACT)=/var/workdir/source | ||
| - name: determine-version | ||
| image: registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:2e8edce823a48e51858f1fad3ff4cbf6875ce8a3f86b9eecf298bc2050c8652a | ||
| workingDir: /var/workdir/source | ||
|
Comment on lines
+178
to
+190
Contributor
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: sed -n '150,220p' .tekton/basic-component-pipeline.yamlRepository: stackrox/stackrox-mcp Length of output: 2674 🏁 Script executed: rg -n "computeResources|resources:" .tekton/basic-component-pipeline.yamlRepository: stackrox/stackrox-mcp Length of output: 159 🏁 Script executed: python3 - <<'PY'
from pathlib import Path
text = Path('.tekton/basic-component-pipeline.yaml').read_text()
for needle in ['computeResources', 'resources:']:
print(needle, text.count(needle))
PYRepository: stackrox/stackrox-mcp Length of output: 191 Set resource requests and limits on the new task steps
🤖 Prompt for AI AgentsSource: Path instructions |
||
| script: | | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
| microdnf install -y git-core | ||
| VERSION=$(git describe --tags --always 2>/dev/null || echo "dev") | ||
|
Contributor
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect the relevant section of the Tekton pipeline and nearby context.
file=".tekton/basic-component-pipeline.yaml"
wc -l "$file"
sed -n '160,230p' "$file"
# Find other uses of git describe / version detection in tekton files.
rg -n "git describe|VERSION=.*dev|dev\"" .tekton -SRepository: stackrox/stackrox-mcp Length of output: 2684 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Map the task definition around the version-detection step.
ast-grep outline .tekton/basic-component-pipeline.yamlRepository: stackrox/stackrox-mcp Length of output: 211 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Locate where the VERSION result is consumed in this pipeline.
rg -n "tasks\.determine-version\.results\.VERSION|determine-version\.results\.VERSION|VERSION" .tekton/basic-component-pipeline.yaml -S
# Read a wider slice around the task and any downstream consumers.
sed -n '180,340p' .tekton/basic-component-pipeline.yamlRepository: stackrox/stackrox-mcp Length of output: 5941 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Check whether the taskSpec has any guard or fallback handling around git metadata.
sed -n '188,208p' .tekton/basic-component-pipeline.yaml
# Inspect surrounding Tekton pipeline parameters/results to understand impact.
sed -n '1,120p' .tekton/basic-component-pipeline.yamlRepository: stackrox/stackrox-mcp Length of output: 5017 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect the clone task and trusted-artifact handoff that feed determine-version.
rg -n "clone-repository|use-trusted-artifact|SOURCE_ARTIFACT|git describe" .tekton/basic-component-pipeline.yaml -n -S
# Read the clone task and the determine-version consumers around the task boundaries.
sed -n '120,210p' .tekton/basic-component-pipeline.yaml
sed -n '230,270p' .tekton/basic-component-pipeline.yamlRepository: stackrox/stackrox-mcp Length of output: 5999 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Read the clone task and nearby pipeline structure to assess whether the repo can be invalid here.
sed -n '1,170p' .tekton/basic-component-pipeline.yamlRepository: stackrox/stackrox-mcp Length of output: 5543 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
import subprocess, textwrap, tempfile, os, shutil, pathlib, sys
# Demonstrate git describe behavior in a normal repo, a repo without tags, and a non-repo.
tmp = tempfile.mkdtemp(prefix="git-describe-check-")
try:
cwd = pathlib.Path(tmp)
subprocess.run(["git", "init", "-q"], cwd=tmp, check=True)
subprocess.run(["git", "config", "user.email", "a@example.com"], cwd=tmp, check=True)
subprocess.run(["git", "config", "user.name", "a"], cwd=tmp, check=True)
(cwd / "f").write_text("x\n")
subprocess.run(["git", "add", "f"], cwd=tmp, check=True)
subprocess.run(["git", "commit", "-q", "-m", "init"], cwd=tmp, check=True)
def run(cmd, cwd):
p = subprocess.run(cmd, cwd=cwd, capture_output=True, text=True)
return p.returncode, p.stdout.strip(), p.stderr.strip()
print("repo-no-tags:", run(["git", "describe", "--tags", "--always"], tmp))
print("non-repo:", run(["git", "describe", "--tags", "--always"], "/tmp"))
finally:
shutil.rmtree(tmp)
PYRepository: stackrox/stackrox-mcp Length of output: 284 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect if any explicit versioning expectations or release tags are documented nearby.
rg -n "dev|release version|git describe|VERSION" -g '!**/*.sum' -g '!**/vendor/**' . -S | head -n 80Repository: stackrox/stackrox-mcp Length of output: 5940 Drop the 🤖 Prompt for AI Agents |
||
| echo "Determined version: ${VERSION}" >&2 | ||
| echo -n "${VERSION}" | tee "$(results.VERSION.path)" | ||
| - name: prefetch-dependencies | ||
| params: | ||
| - name: input | ||
|
|
@@ -210,6 +248,7 @@ spec: | |
| value: $(tasks.clone-repository.results.commit) | ||
| - name: BUILD_ARGS | ||
| value: | ||
| - VERSION=$(tasks.determine-version.results.VERSION) | ||
| - $(params.build-args[*]) | ||
|
Comment on lines
249
to
252
Contributor
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Locate the relevant pipeline and task files
git ls-files '.tekton/**' | sed -n '1,200p'
echo '--- outline basic-component-pipeline.yaml ---'
ast-grep outline .tekton/basic-component-pipeline.yaml --view expanded || true
echo '--- relevant lines in basic-component-pipeline.yaml ---'
nl -ba .tekton/basic-component-pipeline.yaml | sed -n '220,280p'
echo '--- search for BUILD_ARGS / VERSION usage in tekton files ---'
rg -n 'BUILD_ARGS|build-args|determine-version.results.VERSION|VERSION=' .tekton -S
echo '--- locate downstream task definitions ---'
rg -n 'name:\s*(build|sast|.*analysis|.*image|.*component)|BUILD_ARGS' .tekton -SRepository: stackrox/stackrox-mcp Length of output: 466 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect the task that receives BUILD_ARGS and the scripts that consume it.
rg -n 'BUILD_ARGS|build-args|VERSION=' .tekton -S --glob '*.yaml' --glob '*.yml'
# Try to find any referenced task definitions under tekton
fd -t f -e yaml -e yml .tekton
# If a candidate task file exists, show outlines for the likely consumers.
for f in $(fd -t f -e yaml -e yml .tekton); do
if rg -q 'BUILD_ARGS|build-args' "$f"; then
echo "--- $f ---"
ast-grep outline "$f" --view expanded || true
nl -ba "$f" | sed -n '1,260p'
fi
doneRepository: stackrox/stackrox-mcp Length of output: 1188 🏁 Script executed: #!/bin/bash
set -euo pipefail
nl -ba .tekton/basic-component-pipeline.yaml | sed -n '240,270p'
echo '---'
nl -ba .tekton/basic-component-pipeline.yaml | sed -n '500,530p'
echo '---'
rg -n 'BUILD_ARGS|VERSION=' .tekton -SRepository: stackrox/stackrox-mcp Length of output: 199 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Show the full task definitions referenced by the pipeline around the BUILD_ARGS entries.
python3 - <<'PY'
from pathlib import Path
p = Path('.tekton/basic-component-pipeline.yaml')
text = p.read_text()
for marker in ['- name: BUILD_ARGS', 'determine-version.results.VERSION', 'build-args']:
idx = text.find(marker)
print(f'=== {marker} ===')
if idx == -1:
print('not found')
continue
start = text.rfind('\n', 0, idx-200)
if start == -1:
start = 0
end = text.find('\n', idx+400)
if end == -1:
end = len(text)
print(text[start+1:end])
print()
PYRepository: stackrox/stackrox-mcp Length of output: 2110 🏁 Script executed: #!/bin/bash
set -euo pipefail
nl -ba .tekton/basic-component-pipeline.yaml | sed -n '245,255p'
echo '---'
nl -ba .tekton/basic-component-pipeline.yaml | sed -n '505,515p'
echo '---'
rg -n 'build-args|BUILD_ARGS|VERSION=' .tekton -SRepository: stackrox/stackrox-mcp Length of output: 199 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p = Path('.tekton/basic-component-pipeline.yaml')
lines = p.read_text().splitlines()
for start, end in [(220, 290), (490, 530)]:
print(f'--- lines {start+1}-{end} ---')
for i in range(start, min(end, len(lines))):
print(f'{i+1}: {lines[i]}')
PY
echo '--- search all task refs and build-arg consumers ---'
python3 - <<'PY'
from pathlib import Path
import re
for path in Path('.tekton').rglob('*'):
if path.is_file() and path.suffix in {'.yaml', '.yml'}:
text = path.read_text()
if 'BUILD_ARGS' in text or 'build-args' in text or 'buildah' in text:
print(f'=== {path} ===')
for m in re.finditer(r'BUILD_ARGS|build-args|buildah|VERSION=', text):
s = max(0, m.start()-180)
e = min(len(text), m.end()+220)
print(text[s:e].replace('\n', '\n'))
print('---')
PYRepository: stackrox/stackrox-mcp Length of output: 13120 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Find the exact task or script that consumes BUILD_ARGS and how it expands duplicates.
python3 - <<'PY'
from pathlib import Path
import re
def show(path, needle, radius=260):
text = path.read_text()
pos = text.find(needle)
if pos == -1:
return False
s = max(0, pos - radius)
e = min(len(text), pos + len(needle) + radius)
print(f'=== {path} :: {needle} ===')
print(text[s:e])
print()
return True
for path in Path('.').rglob('*'):
if path.is_file() and path.suffix in {'.yaml', '.yml', '.sh', '.bash', '.txt', '.md'}:
txt = path.read_text(errors='ignore')
if 'BUILD_ARGS' in txt or 'build-args' in txt or 'buildah' in txt:
for needle in ['BUILD_ARGS', 'build-args', 'buildah bud', 'buildah build', 'VERSION=']:
show(path, needle)
PYRepository: stackrox/stackrox-mcp Length of output: 3091 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Check whether there are any docs or scripts describing precedence for repeated build args.
rg -n 'last-wins|duplicate|precedence|build-arg|BUILD_ARGS' . -SRepository: stackrox/stackrox-mcp Length of output: 1237 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Search for the task implementation that actually consumes BUILD_ARGS.
rg -n 'BUILD_ARGS|build-args|buildah|--build-arg' . -SRepository: stackrox/stackrox-mcp Length of output: 346 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
terms = ['BUILD_ARGS', 'build-args', '--build-arg', 'buildah', 'bud ', 'buildah bud', 'buildah build']
for path in Path('.').rglob('*'):
if not path.is_file():
continue
if path.suffix.lower() not in {'.yaml', '.yml', '.sh', '.bash', '.md', '.txt', '.json', '.go', '.js', '.ts'}:
continue
try:
text = path.read_text()
except Exception:
continue
if any(t in text for t in terms):
print(f'=== {path} ===')
for t in terms:
idx = text.find(t)
if idx != -1:
s = max(0, idx - 200)
e = min(len(text), idx + 500)
print(text[s:e])
print('---')
PYRepository: stackrox/stackrox-mcp Length of output: 3768 🌐 Web query:
💡 Result: When using buildah build, build arguments are merged across all provided --build-arg and --build-arg-file options [1][2][3]. When a specific build argument name is provided multiple times, the last instance processed is the one that takes precedence and is passed to the build [1][4][3]. Because files specified via --build-arg-file are read before the arguments supplied directly via --build-arg on the command line, values provided via --build-arg will override any conflicting values defined in --build-arg-file [1][5][3]. Citations:
Keep the generated 🤖 Prompt for AI Agents |
||
| - name: BUILD_ARGS_FILE | ||
| value: $(params.build-args-file) | ||
|
|
@@ -469,6 +508,7 @@ spec: | |
| value: $(tasks.clone-repository.results.commit) | ||
| - name: BUILD_ARGS | ||
| value: | ||
| - VERSION=$(tasks.determine-version.results.VERSION) | ||
| - $(params.build-args[*]) | ||
| - name: BUILD_ARGS_FILE | ||
| value: $(params.build-args-file) | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
Repository: stackrox/stackrox-mcp
Length of output: 256
🏁 Script executed:
Repository: stackrox/stackrox-mcp
Length of output: 7844
🏁 Script executed:
Repository: stackrox/stackrox-mcp
Length of output: 7844
Move these step images behind a bundle or params. These images are embedded directly in the inline
taskSpec; parameterize them or extract the step into a bundled Task to match the.tekton/**image policy.🤖 Prompt for AI Agents
Source: Path instructions