From 1900fc0d36ebaf1723bf46bc25969784c4515735 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Thu, 23 Jul 2026 12:34:22 +0200 Subject: [PATCH] Split main and release pipeline to remove image expire --- .tekton/acs-mcp-server-pull-request.yaml | 6 +- ...ush.yaml => acs-mcp-server-push-main.yaml} | 25 +++--- .tekton/acs-mcp-server-push-release.yaml | 85 +++++++++++++++++++ 3 files changed, 99 insertions(+), 17 deletions(-) rename .tekton/{acs-mcp-server-push.yaml => acs-mcp-server-push-main.yaml} (77%) create mode 100644 .tekton/acs-mcp-server-push-release.yaml diff --git a/.tekton/acs-mcp-server-pull-request.yaml b/.tekton/acs-mcp-server-pull-request.yaml index b557c33..741de7b 100644 --- a/.tekton/acs-mcp-server-pull-request.yaml +++ b/.tekton/acs-mcp-server-pull-request.yaml @@ -18,8 +18,8 @@ metadata: target_branch == "main" || target_branch.startsWith("release-") || ( - has(body.pull_request) && - has(body.pull_request.labels) && + has(body.pull_request) && + has(body.pull_request.labels) && body.pull_request.labels.exists(l, l.name == "konflux-build") ) ) @@ -39,7 +39,7 @@ spec: - name: output-image-repo value: quay.io/redhat-user-workloads/agentic-cluster-security-suite-tenant/acs-mcp-server - name: image-expires-after - value: 5d + value: "5d" - name: dockerfile value: konflux.Dockerfile - name: hermetic diff --git a/.tekton/acs-mcp-server-push.yaml b/.tekton/acs-mcp-server-push-main.yaml similarity index 77% rename from .tekton/acs-mcp-server-push.yaml rename to .tekton/acs-mcp-server-push-main.yaml index 381c030..ef8a04f 100644 --- a/.tekton/acs-mcp-server-push.yaml +++ b/.tekton/acs-mcp-server-push-main.yaml @@ -9,30 +9,27 @@ metadata: pipelinesascode.tekton.dev/max-keep-runs: "10" pipelinesascode.tekton.dev/on-label: "[]" # For push trigger: - # - trigger on commit push on main or release branch. - # - trigger on tag pushes. + # - trigger on commit push on main. # For PR triggers: # - body.action != "ready_for_review" prevents double-triggering when a draft PR is marked ready for review. - # - trigger only for PRs on release branches. - # - support triggering by label: "konflux-build" + # - trigger only for PRs on main branch with label: "konflux-build" pipelinesascode.tekton.dev/on-cel-expression: | ( - event == "push" && target_branch.matches("^(main|release-.*|refs/tags/.*)$") + event == "push" && + target_branch.matches("^main$") ) || ( - event == "pull_request" && body.action != "ready_for_review" && ( - target_branch.startsWith("release-") || - ( - has(body.pull_request) && - has(body.pull_request.labels) && - body.pull_request.labels.exists(l, l.name == "konflux-build") - ) - ) + event == "pull_request" && + target_branch.matches("^main$") && + body.action != "ready_for_review" && + has(body.pull_request) && + has(body.pull_request.labels) && + body.pull_request.labels.exists(l, l.name == "konflux-build") ) labels: appstudio.openshift.io/application: agentic-cluster-security-suite-0-2 appstudio.openshift.io/component: acs-mcp-server-0-2 pipelines.appstudio.openshift.io/type: build - name: acs-mcp-server-on-push + name: acs-mcp-server-on-push-main namespace: agentic-cluster-security-suite-tenant spec: params: diff --git a/.tekton/acs-mcp-server-push-release.yaml b/.tekton/acs-mcp-server-push-release.yaml new file mode 100644 index 0000000..7a24afd --- /dev/null +++ b/.tekton/acs-mcp-server-push-release.yaml @@ -0,0 +1,85 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + annotations: + build.appstudio.openshift.io/repo: https://github.com/stackrox/stackrox-mcp?rev={{revision}} + build.appstudio.redhat.com/commit_sha: '{{revision}}' + build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' + build.appstudio.redhat.com/target_branch: '{{target_branch}}' + pipelinesascode.tekton.dev/max-keep-runs: "10" + pipelinesascode.tekton.dev/on-label: "[]" + # For push trigger: + # - trigger on commit push on release branches. + # - trigger on tag pushes. + # For PR triggers: + # - body.action != "ready_for_review" prevents double-triggering when a draft PR is marked ready for review. + # - trigger only for PRs on release branches with label: "konflux-build" + pipelinesascode.tekton.dev/on-cel-expression: | + ( + event == "push" && target_branch.matches("^(release-.*|refs/tags/.*)$") + ) || ( + event == "pull_request" && + target_branch.startsWith("release-") && + body.action != "ready_for_review" && + has(body.pull_request) && + has(body.pull_request.labels) && + body.pull_request.labels.exists(l, l.name == "konflux-build") + ) + labels: + appstudio.openshift.io/application: agentic-cluster-security-suite-0-2 + appstudio.openshift.io/component: acs-mcp-server-0-2 + pipelines.appstudio.openshift.io/type: build + name: acs-mcp-server-on-push-release + namespace: agentic-cluster-security-suite-tenant +spec: + params: + - name: git-url + value: '{{source_url}}' + - name: revision + value: '{{revision}}' + - name: output-image-repo + value: quay.io/redhat-user-workloads/agentic-cluster-security-suite-tenant/acs-mcp-server + - name: dockerfile + value: konflux.Dockerfile + - name: hermetic + value: 'true' + - name: prefetch-input + value: | + [ + { "type": "gomod", "path": "." }, + { "type": "rpm", "path": "." } + ] + - name: build-source-image + value: 'true' + - name: build-image-index + value: 'true' + - name: clone-depth + value: '0' + - name: clone-fetch-tags + value: 'true' + - name: build-platforms + value: + - linux/amd64 + - linux/arm64 + - linux/ppc64le + - linux/s390x + - name: extra-labels + value: + # X.Y in the cpe label must be adjusted for every version stream. + - "cpe=cpe:/a:redhat:agentic_cluster_security_suite:0.2::el9" + + pipelineRef: + name: basic-component-pipeline + + taskRunTemplate: + serviceAccountName: build-pipeline-acs-mcp-server-0-2 + + timeouts: + tasks: 1h + finally: 10m + pipeline: 1h10m + + workspaces: + - name: git-auth + secret: + secretName: '{{ git_auth_secret }}'