test: run ITS pipeline e2e checks on pull requests #3574
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| apiVersion: tekton.dev/v1 | ||
| kind: PipelineRun | ||
| metadata: | ||
| annotations: | ||
| build.appstudio.openshift.io/repo: https://github.com/conforma/cli?rev={{revision}} | ||
| build.appstudio.redhat.com/commit_sha: '{{revision}}' | ||
| build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' | ||
| build.appstudio.redhat.com/target_branch: '{{target_branch}}' | ||
| pipelinesascode.tekton.dev/cancel-in-progress: "true" | ||
| pipelinesascode.tekton.dev/max-keep-runs: "3" | ||
| pipelinesascode.tekton.dev/on-cel-expression: | | ||
| event == "pull_request" && target_branch == "main" && | ||
| ("pipelines/enterprise-contract/**".pathChanged() || | ||
| ".tekton/cli-its-pull-request.yaml".pathChanged()) | ||
| labels: | ||
| appstudio.openshift.io/application: ec-main | ||
| appstudio.openshift.io/component: cli-main | ||
| pipelines.appstudio.openshift.io/type: test | ||
| name: cli-its-on-pull-request | ||
| namespace: rhtap-contract-tenant | ||
| spec: | ||
| params: | ||
| - name: git-url | ||
| value: https://github.com/conforma/e2e-tests.git | ||
| - name: revision | ||
| value: 715c96ced8341ce10f5ab5b800ddcdec8b3d9e79 | ||
| - name: oci-container-repo | ||
| value: quay.io/conforma/e2e-tests | ||
| - name: oci-container-repo-credentials-secret | ||
| value: konflux-test-infra | ||
| - name: aws-credentials-secret | ||
| value: mapt-kind-secret | ||
| - name: deprovision-aws-credentials-secret | ||
| value: mapt-kind-secret | ||
| - name: its-pipeline-repo-url | ||
| value: '{{source_url}}' | ||
| - name: its-pipeline-revision | ||
| value: '{{revision}}' | ||
| - name: its-pipeline-path | ||
| value: pipelines/enterprise-contract/0.1/enterprise-contract.yaml | ||
| - name: test-label-filter | ||
| value: its-pipeline | ||
| # Keep the runner and test-suite revisions pinned to the same reviewed commit. | ||
| pipelineRef: | ||
| resolver: git | ||
| params: | ||
| - name: url | ||
| value: https://github.com/conforma/e2e-tests.git | ||
| - name: revision | ||
| value: 715c96ced8341ce10f5ab5b800ddcdec8b3d9e79 | ||
|
There was a problem hiding this comment. [high] supply-chain Both spec.params[revision] (line 26) and spec.pipelineRef.params[revision] (line 50) pin to conforma/e2e-tests SHA 715c96ced8341ce10f5ab5b800ddcdec8b3d9e79, which is the HEAD of the still-open PR conforma/e2e-tests#12. That commit has not landed on the e2e-tests main branch, so the pipeline being executed here has not cleared its own repo review/merge gate. If #12 is squash-merged, the resulting merge commit will have a different SHA and both pins here will silently reference an orphaned commit. The inline comment on line 43 claims the revision is reviewed, but the reviewed gate for e2e-tests is merge to main. Suggested fix: Block merge until conforma/e2e-tests#12 is merged to main, then update both revision values (line 26 and line 50) to the resulting upstream merge-commit SHA. Keep the PR in draft until the dependency lands. |
||
| - name: pathInRepo | ||
| value: .tekton/pipelines/conforma-e2e/pipeline.yaml | ||
| taskRunTemplate: | ||
| serviceAccountName: konflux-integration-runner | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[high] fork-controlled-code-with-secrets
Params its-pipeline-repo-url: {{source_url}} (line 36) and its-pipeline-revision: {{revision}} (line 38) cause the runner to fetch and execute an ITS pipeline definition drawn from the PR source repo/revision. The CEL trigger (lines 11-14) only gates on event == pull_request and target_branch == main; there is no author_association, org-membership, or /ok-to-test guard expressed in this file. A fork-authored PR that touches pipelines/enterprise-contract/** or this trigger file will therefore cause fork-controlled YAML to be interpreted by the runner in namespace rhtap-contract-tenant under service account konflux-integration-runner with konflux-test-infra (registry creds) and mapt-kind-secret (AWS creds) mounted. Protection today rests entirely on the out-of-band PaC approver gate.
Suggested fix: Pick one or more of: (a) restrict its-pipeline-repo-url/its-pipeline-revision to the trusted upstream (base repo/base ref); (b) tighten the CEL to require a trusted actor, e.g. body.pull_request.author_association in [MEMBER, OWNER, COLLABORATOR]; or (c) explicitly document and enforce the PaC approver gate (/ok-to-test required for fork PRs) on this Repository CR. Also consider removing AWS/registry secrets from this PR-triggered variant if they are not needed for the ITS pipeline lint/schema checks.