RHOAIENG-18401: chore(.tekton/): implement Public Konflux build for O…

…DH-io/kubeflow repository

.github/renovate.json → .github/renovate.json5

@@ -1,3 +1,5 @@
+// This file is ignored if `.github/renovate.json` is also present,
+// see https://docs.renovatebot.com/configuration-options/#configuration-options and https://json5.org.
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "description": [
@@ -77,10 +79,6 @@
         "enabled": false
       }
     ],
-    "ignorePaths": [
-      "**/Dockerfile",
-      "!**/Dockerfile.konflux*"
-    ],
     "pinDigests": true
   },
   "tekton": {

.tekton/image-registry.yaml

@@ -0,0 +1,75 @@
+---
+# List of images referenced from the Python code generation scripts for Tekton pipelines.
+#
+# The structure of this file must be compatible with
+# https://docs.renovatebot.com/modules/manager/tekton/
+#
+# Specifically, see `function getDeps` and `function getBundleValue()` in
+# https://github.com/renovatebot/renovate/blob/main/lib/modules/manager/tekton/extract.ts
+#
+# This is using the 'older-style' bundle references (see ^^^), because they are a bit less verbose
+#
+# Konflux (MintMaker) will then update the hashes in this yaml together with the generated Tekton pipelines
+# because the default renovate.json config includes `.tekton/**.yaml` (and `.yml`) files
+# https://github.com/konflux-ci/mintmaker/blob/289fefb5c7ac18c978b96080c2628d55d0712e83/config/renovate/renovate.json#L62-L70
+items:
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.3@sha256:11b9ce26fd2933ccc81ca3f983e094ec54326a2e0aaf8bdcc4c0b8fea1a42c53
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.3@sha256:11b9ce26fd2933ccc81ca3f983e094ec54326a2e0aaf8bdcc4c0b8fea1a42c53
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:945a7c9066d3e0a95d3fddb7e8a6992e4d632a2a75d8f3a9bd2ff2fef0ec9aa0
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:90dda596d44b3f861889da2fba161dff34c6116fe76c3989e3f84262ea0f29cd
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:f72fcca6732516339d55ac5f01660e287968e64e857a40a8608db27e298b5126
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.1@sha256:994f816e36ac832f4020647afd69223a015c84c503f925013c573fed52f05420
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:479775c8655d815fb515aeb97efc0e64284a8520c452754981970900b937a393
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.1@sha256:75e882bf1619dd45a4043060ce42a6ad3ce781264ade5b7f66a1d994ee159126
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.4@sha256:650330fde0773f73f6bac77ae573031c44c79165d9503b0d5ec1db3e6ef981d7
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.2@sha256:907f11c67b0330480cbf85c23b1085acc5a049ab90af980169251860a3d97ef7
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.1@sha256:df8a25a3431a70544172ed4844f9d0c6229d39130633960729f825a031a7dea9
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.3@sha256:af93b35e6e71a6ff7f3785ad8d8497b11204a5c0c33ab1a78b44f9d43f49c7a5
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.2@sha256:c12e7a774bb07ad2796c01071b0dc0f199111b0ee99c45b55fa599e23b200bae
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.1@sha256:fde1e556e69b8293a38d815473040f0d1ee3567c520c52cb1bd4ea712c715b4f
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check-oci-ta:0.1@sha256:18c1c2665cdb10ca589f69f75f2bb49758f9ed75b69a9171d562856dec3cfd76
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:7553ec6925d0586b286502669b8e31a39dc73501f657426bac99019ac598d6ab
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:7553ec6925d0586b286502669b8e31a39dc73501f657426bac99019ac598d6ab
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.1@sha256:2c2d88c07623b2d25163994ded6e9f29205ea5bbab090f4c86379739940028b9
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:98ccae6ac132ab837fc51a70514be5fca656e09d6d4ad93230bd10f0119258aa
+  - spec:
+      taskRef:
+        bundle: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:39cd56ffa26ff5edfd5bf9b61e902cae35a345c078cd9dcbc0737d30f3ce5ef1