From 41fac7b0330baead3be45581bb07b14982b1a7aa Mon Sep 17 00:00:00 2001 From: Jan Smid Date: Mon, 7 Sep 2026 15:48:29 +0200 Subject: [PATCH] chore(EC-2153): remove RH-specific task defaults --- .../pages/verify-conforma-konflux-ta.adoc | 2 - .../pages/verify-enterprise-contract.adoc | 2 - .../__snapshots__/ta_task_validate_image.snap | 3 +- .../__snapshots__/task_validate_image.snap | 3 +- hack/update-policy-digest-in-tasks.sh | 59 ------------------- .../0.1/verify-conforma-konflux-ta.yaml | 8 +-- .../0.1/verify-enterprise-contract.yaml | 8 +-- 7 files changed, 4 insertions(+), 81 deletions(-) delete mode 100755 hack/update-policy-digest-in-tasks.sh diff --git a/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc b/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc index 437aaf3fe7..693982d630 100644 --- a/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc +++ b/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc @@ -62,8 +62,6 @@ paths can be provided by using the `:` separator. *Default*: `false` *EXTRA_RULE_DATA* (`string`):: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..." *POLICY_BUNDLE_DIGEST* (`string`):: Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...). -+ -*Default*: `sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2` *WORKERS* (`string`):: Number of parallel workers to use for policy evaluation. + diff --git a/docs/modules/ROOT/pages/verify-enterprise-contract.adoc b/docs/modules/ROOT/pages/verify-enterprise-contract.adoc index 5523113ce0..30e15ca911 100644 --- a/docs/modules/ROOT/pages/verify-enterprise-contract.adoc +++ b/docs/modules/ROOT/pages/verify-enterprise-contract.adoc @@ -73,8 +73,6 @@ paths can be provided by using the `:` separator. *Default*: `false` *EXTRA_RULE_DATA* (`string`):: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..." *POLICY_BUNDLE_DIGEST* (`string`):: Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...). -+ -*Default*: `sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2` *WORKERS* (`string`):: Number of parallel workers to use for policy evaluation. + *Default*: `1` diff --git a/features/__snapshots__/ta_task_validate_image.snap b/features/__snapshots__/ta_task_validate_image.snap index 24d0d1e41e..79f9e8895a 100644 --- a/features/__snapshots__/ta_task_validate_image.snap +++ b/features/__snapshots__/ta_task_validate_image.snap @@ -1,7 +1,6 @@ [TestFeatures/Golden container image with trusted artifacts:pin-policy-bundle - 1] -Applying policy bundle digest override: sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2 -'oci::quay.io/conforma/release-policy:konflux' not found in policy configuration, nothing to do. +POLICY_BUNDLE_DIGEST is empty, skipping policy bundle digest override. --- diff --git a/features/__snapshots__/task_validate_image.snap b/features/__snapshots__/task_validate_image.snap index b1fb8ea1f4..4e6582ca7c 100644 --- a/features/__snapshots__/task_validate_image.snap +++ b/features/__snapshots__/task_validate_image.snap @@ -40,8 +40,7 @@ Error: Get "http://tuf.invalid/root.json": dial tcp: lookup tuf.invalid on 10.96 --- [TestFeatures/Golden container image:pin-policy-bundle - 1] -Applying policy bundle digest override: sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2 -'oci::quay.io/conforma/release-policy:konflux' not found in policy configuration, nothing to do. +POLICY_BUNDLE_DIGEST is empty, skipping policy bundle digest override. --- diff --git a/hack/update-policy-digest-in-tasks.sh b/hack/update-policy-digest-in-tasks.sh deleted file mode 100755 index 7e9ba337af..0000000000 --- a/hack/update-policy-digest-in-tasks.sh +++ /dev/null @@ -1,59 +0,0 @@ -#!/usr/bin/env bash -# Copyright The Conforma Contributors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# SPDX-License-Identifier: Apache-2.0 - -# Update the POLICY_BUNDLE_DIGEST default value in tekton task definitions. - -set -o errexit -set -o nounset -set -o pipefail - -IMAGE="${IMAGE:-"quay.io/conforma/release-policy:konflux"}" - -# The two task definitions are the important placess where the digest -# should update, but it also appears in some tests, and in the docs. -# Update all those files as well so the change is ready to merge. -FILES=( - tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml - tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml - docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc - docs/modules/ROOT/pages/verify-enterprise-contract.adoc - features/__snapshots__/task_validate_image.snap - features/task_validate_image.feature -) - -MANIFEST=$(skopeo inspect --raw "docker://${IMAGE}") -HASH=$(echo -n "${MANIFEST}" | sha256sum | awk '{print $1}') -NEW_DIGEST="sha256:${HASH}" - -OLD_DIGEST=$(sed -n '/- name: POLICY_BUNDLE_DIGEST$/,/- name: /{s/.*default: "\(sha256:[a-f0-9]*\)".*/\1/p;}' "${FILES[0]}") - -echo "Old digest: ${OLD_DIGEST}" -echo "New digest: ${NEW_DIGEST}" - -if [[ "${OLD_DIGEST}" == "${NEW_DIGEST}" ]]; then - echo "Already up to date." - exit 0 -fi - -for f in "${FILES[@]}"; do - if [[ ! -f "${f}" ]]; then - echo "Warning: ${f} not found, skipping" >&2 - continue - fi - sed -i "s|${OLD_DIGEST}|${NEW_DIGEST}|g" "${f}" - echo "Updated ${f}" -done diff --git a/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml b/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml index 019ecc9c1c..cfbac464ac 100644 --- a/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml +++ b/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml @@ -169,13 +169,7 @@ spec: oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...). - # For Konflux stability we want to try pinning the policy bundle rather - # than use the floating oci::quay.io/conforma/release-policy:konflux tag. - # Instead of needing to bump this in hundreds of separate ECPs, we'll do - # it here instead. If you don't want this behavior then provide an empty - # string value for this param. To update this digest use the script in - # hack/update-policy-digest-in-tasks.sh - default: "sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2" + default: "" - name: WORKERS type: string diff --git a/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml b/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml index 917372ef48..96b0f4143d 100644 --- a/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml +++ b/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml @@ -176,13 +176,7 @@ spec: oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...). - # For Konflux stability we want to try pinning the policy bundle rather - # than use the floating oci::quay.io/conforma/release-policy:konflux tag. - # Instead of needing to bump this in hundreds of separate ECPs, we'll do - # it here instead. If you don't want this behavior then provide an empty - # string value for this param. To update this digest use the script in - # hack/update-policy-digest-in-tasks.sh - default: "sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2" + default: "" - name: WORKERS type: string