apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  generateName: tekton-results-migrator-on-push-
  annotations:
    pipelinesascode.tekton.dev/on-target-branch: '[downstream-*]'
    appstudio.openshift.io/core-services-ci: '1'
    pipelinesascode.tekton.dev/repo-url: 'https://github.com/openshift-pipelines/tektoncd-results'
    pipelinesascode.tekton.dev/sha-title: 'Merge pull request #40 from sayan-biswas/type-migrator'
    results.tekton.dev/record: >-
      tekton-ci/results/ce59052d-9d64-426f-a8e5-908ee3dc5697/records/ce59052d-9d64-426f-a8e5-908ee3dc5697
    pipelinesascode.tekton.dev/git-auth-secret: pac-gitauth-whew
    chains.tekton.dev/signed: 'true'
    results.tekton.dev/result: tekton-ci/results/ce59052d-9d64-426f-a8e5-908ee3dc5697
    pipelinesascode.tekton.dev/log-url: >-
      https://console-openshift-console.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/k8s/ns/tekton-ci/tekton.dev~v1beta1~PipelineRun/tekton-results-migrator-on-push-xqhhw
    pipelinesascode.tekton.dev/max-keep-runs: '5'
    pipelinesascode.tekton.dev/sha-url: >-
      https://github.com/openshift-pipelines/tektoncd-results/commit/4c93d5c4f34d96d31ade787ee1856d144e342143
    pipelinesascode.tekton.dev/on-event: '[push]'
    pipelinesascode.tekton.dev/installation-id: '34496476'
  resourceVersion: '106513061'
  name: tekton-results-migrator-on-push-xqhhw
  uid: ce59052d-9d64-426f-a8e5-908ee3dc5697
  creationTimestamp: '2023-04-13T14:21:34Z'
  generation: 1
  managedFields:
    - apiVersion: tekton.dev/v1beta1
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:annotations':
            'f:pipelinesascode.tekton.dev/on-event': {}
            'f:pipelinesascode.tekton.dev/log-url': {}
            'f:pipelinesascode.tekton.dev/max-keep-runs': {}
            'f:pipelinesascode.tekton.dev/on-target-branch': {}
            .: {}
            'f:pipelinesascode.tekton.dev/repo-url': {}
            'f:pipelinesascode.tekton.dev/sha-url': {}
            'f:pipelinesascode.tekton.dev/installation-id': {}
            'f:pipelinesascode.tekton.dev/sha-title': {}
            'f:pipelinesascode.tekton.dev/git-auth-secret': {}
          'f:generateName': {}
          'f:labels':
            'f:pipelinesascode.tekton.dev/url-repository': {}
            'f:pipelinesascode.tekton.dev/repository': {}
            'f:app.kubernetes.io/managed-by': {}
            'f:pipelinesascode.tekton.dev/url-org': {}
            'f:pipelinesascode.tekton.dev/git-provider': {}
            'f:pipelinesascode.tekton.dev/event-type': {}
            'f:pipelinesascode.tekton.dev/original-prname': {}
            .: {}
            'f:pipelinesascode.tekton.dev/sha': {}
            'f:pipelinesascode.tekton.dev/sender': {}
            'f:app.kubernetes.io/version': {}
            'f:pipelinesascode.tekton.dev/branch': {}
            'f:pipelinesascode.tekton.dev/check-run-id': {}
        'f:spec':
          .: {}
          'f:params': {}
          'f:pipelineRef':
            .: {}
            'f:bundle': {}
            'f:name': {}
          'f:workspaces': {}
      manager: pipelines-as-code-controller
      operation: Update
      time: '2023-04-13T14:21:34Z'
    - apiVersion: tekton.dev/v1beta1
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:annotations':
            'f:results.tekton.dev/record': {}
            'f:results.tekton.dev/result': {}
      manager: watcher
      operation: Update
      time: '2023-04-13T14:21:34Z'
    - apiVersion: tekton.dev/v1beta1
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:annotations':
            'f:appstudio.openshift.io/core-services-ci': {}
          'f:labels':
            'f:pipelines.openshift.io/runtime': {}
            'f:pipelines.openshift.io/strategy': {}
            'f:pipelines.openshift.io/used-by': {}
            'f:tekton.dev/pipeline': {}
      manager: openshift-pipelines-controller
      operation: Update
      time: '2023-04-13T14:21:39Z'
    - apiVersion: tekton.dev/v1beta1
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:finalizers':
            .: {}
            'v:"pipelinesascode.tekton.dev"': {}
          'f:labels':
            'f:pipelinesascode.tekton.dev/state': {}
      manager: pipelines-as-code-watcher
      operation: Update
      time: '2023-04-13T14:22:51Z'
    - apiVersion: tekton.dev/v1beta1
      fieldsType: FieldsV1
      fieldsV1:
        'f:status':
          .: {}
          'f:childReferences': {}
          'f:completionTime': {}
          'f:conditions': {}
          'f:pipelineSpec':
            .: {}
            'f:finally': {}
            'f:params': {}
            'f:results': {}
            'f:tasks': {}
            'f:workspaces': {}
          'f:skippedTasks': {}
          'f:startTime': {}
          'f:taskRuns':
            .: {}
            'f:tekton-results-migrator-on-push-xqhhw-build-container':
              .: {}
              'f:pipelineTaskName': {}
              'f:status':
                .: {}
                'f:completionTime': {}
                'f:conditions': {}
                'f:podName': {}
                'f:startTime': {}
                'f:steps': {}
                'f:taskResults': {}
                'f:taskSpec':
                  .: {}
                  'f:description': {}
                  'f:params': {}
                  'f:results': {}
                  'f:stepTemplate':
                    .: {}
                    'f:env': {}
                    'f:name': {}
                    'f:resources': {}
                  'f:steps': {}
                  'f:volumes': {}
                  'f:workspaces': {}
              'f:whenExpressions': {}
            'f:tekton-results-migrator-on-push-xqhhw-clone-repository':
              .: {}
              'f:pipelineTaskName': {}
              'f:status':
                .: {}
                'f:completionTime': {}
                'f:conditions': {}
                'f:podName': {}
                'f:startTime': {}
                'f:steps': {}
                'f:taskResults': {}
                'f:taskSpec':
                  .: {}
                  'f:description': {}
                  'f:params': {}
                  'f:results': {}
                  'f:steps': {}
                  'f:workspaces': {}
              'f:whenExpressions': {}
            'f:tekton-results-migrator-on-push-xqhhw-init':
              .: {}
              'f:pipelineTaskName': {}
              'f:status':
                .: {}
                'f:completionTime': {}
                'f:conditions': {}
                'f:podName': {}
                'f:startTime': {}
                'f:steps': {}
                'f:taskResults': {}
                'f:taskSpec':
                  .: {}
                  'f:description': {}
                  'f:params': {}
                  'f:results': {}
                  'f:steps': {}
                  'f:volumes': {}
            'f:tekton-results-migrator-on-push-xqhhw-sast-snyk-check':
              .: {}
              'f:pipelineTaskName': {}
              'f:status':
                .: {}
                'f:completionTime': {}
                'f:conditions': {}
                'f:podName': {}
                'f:startTime': {}
                'f:steps': {}
                'f:taskSpec':
                  .: {}
                  'f:description': {}
                  'f:params': {}
                  'f:results': {}
                  'f:steps': {}
                  'f:volumes': {}
                  'f:workspaces': {}
              'f:whenExpressions': {}
      manager: openshift-pipelines-controller
      operation: Update
      subresource: status
      time: '2023-04-13T14:24:56Z'
    - apiVersion: tekton.dev/v1beta1
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:annotations':
            'f:chains.tekton.dev/signed': {}
          'f:finalizers':
            'v:"chains.tekton.dev/pipelinerun"': {}
      manager: controller
      operation: Update
      time: '2023-04-13T14:24:59Z'
  namespace: tekton-ci
  finalizers:
    - pipelinesascode.tekton.dev
    - chains.tekton.dev/pipelinerun
  labels:
    pipelinesascode.tekton.dev/state: completed
    pipelines.openshift.io/runtime: generic
    pipelinesascode.tekton.dev/sender: adambkaplan
    pipelines.openshift.io/strategy: docker
    app.kubernetes.io/version: v0.16.0
    tekton.dev/pipeline: docker-build
    pipelines.openshift.io/used-by: build-cloud
    app.kubernetes.io/managed-by: pipelinesascode.tekton.dev
    pipelinesascode.tekton.dev/check-run-id: '12724579121'
    pipelinesascode.tekton.dev/branch: refs-heads-downstream-0.5.0-01
    pipelinesascode.tekton.dev/url-org: openshift-pipelines
    pipelinesascode.tekton.dev/original-prname: tekton-results-migrator-on-push
    pipelinesascode.tekton.dev/url-repository: tektoncd-results
    pipelinesascode.tekton.dev/repository: tekton-results
    pipelinesascode.tekton.dev/sha: 4c93d5c4f34d96d31ade787ee1856d144e342143
    pipelinesascode.tekton.dev/git-provider: github
    pipelinesascode.tekton.dev/event-type: push
spec:
  params:
    - name: git-url
      value: 'https://github.com/openshift-pipelines/tektoncd-results'
    - name: revision
      value: 4c93d5c4f34d96d31ade787ee1856d144e342143
    - name: output-image
      value: >-
        quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
    - name: dockerfile
      value: images/migrator/Dockerfile
  pipelineRef:
    bundle: >-
      quay.io/redhat-appstudio-tekton-catalog/pipeline-core-services-docker-build:latest
    name: docker-build
  serviceAccountName: pipeline
  timeout: 1h0m0s
  workspaces:
    - name: workspace
      volumeClaimTemplate:
        metadata:
          creationTimestamp: null
        spec:
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: 1Gi
        status: {}
status:
  childReferences:
    - apiVersion: tekton.dev/v1beta1
      kind: TaskRun
      name: tekton-results-migrator-on-push-xqhhw-init
      pipelineTaskName: init
    - apiVersion: tekton.dev/v1beta1
      kind: TaskRun
      name: tekton-results-migrator-on-push-xqhhw-clone-repository
      pipelineTaskName: clone-repository
      whenExpressions:
        - input: $(tasks.init.results.build)
          operator: in
          values:
            - 'true'
    - apiVersion: tekton.dev/v1beta1
      kind: TaskRun
      name: tekton-results-migrator-on-push-xqhhw-build-container
      pipelineTaskName: build-container
      whenExpressions:
        - input: $(tasks.init.results.build)
          operator: in
          values:
            - 'true'
    - apiVersion: tekton.dev/v1beta1
      kind: TaskRun
      name: tekton-results-migrator-on-push-xqhhw-sast-snyk-check
      pipelineTaskName: sast-snyk-check
      whenExpressions:
        - input: 'false'
          operator: in
          values:
            - 'false'
        - input: snyk-shared-secret
          operator: notin
          values:
            - ''
  completionTime: '2023-04-13T14:22:50Z'
  conditions:
    - lastTransitionTime: '2023-04-13T14:22:50Z'
      message: >-
        Pipeline tekton-ci/docker-build can't be Run; it contains Tasks that
        don't exist: Couldn't retrieve Task "clamav-scan": yaml: control
        characters are not allowed
      reason: CouldntGetTask
      status: 'False'
      type: Succeeded
  pipelineSpec:
    finally:
      - name: show-sbom
        params:
          - name: IMAGE_URL
            value: $(tasks.build-container.results.IMAGE_URL)
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-show-sbom:0.1@sha256:050bab50254e0377c68d63b6b679decfc655e30cad9ce4b0407fc8468852008d
          kind: Task
          name: show-sbom
        status:
          reason: Cancelled
      - name: show-summary
        params:
          - name: pipelinerun-name
            value: tekton-results-migrator-on-push-xqhhw
          - name: git-url
            value: >-
              $(tasks.clone-repository.results.url)?rev=$(tasks.clone-repository.results.commit)
          - name: image-url
            value: >-
              quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
          - name: build-task-status
            value: $(tasks.build-container.status)
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-summary:0.1@sha256:9e21e57456c026c15765db23b986e47fc1394fa5d4823d3038b697971dd1a2bd
          kind: Task
          name: summary
        status:
          reason: Cancelled
      - name: infra-deployments-mr
        params:
          - name: ORIGIN_REPO
            value: 'https://github.com/openshift-pipelines/tektoncd-results'
          - name: REVISION
            value: 4c93d5c4f34d96d31ade787ee1856d144e342143
          - name: SCRIPT
            value: ''
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-update-infra-deployments:0.1@sha256:fa0c7332ca2f5c8970b70a32fc1bcb2482d8be4941f59622e7d1c0ef5e090cc5
          kind: Task
          name: update-infra-deployments
        when:
          - input: ''
            operator: notin
            values:
              - ''
          - input: $(tasks.status)
            operator: notin
            values:
              - Failed
        status:
          reason: Cancelled
    params:
      - description: Source Repository URL
        name: git-url
        type: string
      - default: ''
        description: Revision of the Source Repository
        name: revision
        type: string
      - description: Fully Qualified Output Image
        name: output-image
        type: string
      - default: .
        description: The path to your source code
        name: path-context
        type: string
      - default: Dockerfile
        description: Path to the Dockerfile
        name: dockerfile
        type: string
      - default: 'false'
        description: Force rebuild image
        name: rebuild
        type: string
      - default: 'false'
        description: Skip checks against built image
        name: skip-checks
        type: string
      - default: 'false'
        description: Execute the build with network isolation
        name: hermetic
        type: string
      - default: ''
        description: Build dependencies to be prefetched by Cachi2
        name: prefetch-input
        type: string
      - default: 'false'
        description: Java build
        name: java
        type: string
      - default: snyk-shared-secret
        description: Snyk Token Secret Name
        name: snyk-secret
        type: string
      - default: ''
        name: infra-deployment-update-script
        type: string
    results:
      - description: ''
        name: IMAGE_URL
        value: $(tasks.build-container.results.IMAGE_URL)
      - description: ''
        name: IMAGE_DIGEST
        value: $(tasks.build-container.results.IMAGE_DIGEST)
      - description: ''
        name: CHAINS-GIT_URL
        value: $(tasks.clone-repository.results.url)
      - description: ''
        name: CHAINS-GIT_COMMIT
        value: $(tasks.clone-repository.results.commit)
      - description: ''
        name: JAVA_COMMUNITY_DEPENDENCIES
        value: $(tasks.build-container.results.JAVA_COMMUNITY_DEPENDENCIES)
    tasks:
      - name: init
        params:
          - name: image-url
            value: >-
              quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
          - name: rebuild
            value: 'false'
          - name: skip-checks
            value: 'false'
          - name: pipelinerun-name
            value: tekton-results-migrator-on-push-xqhhw
          - name: pipelinerun-uid
            value: ce59052d-9d64-426f-a8e5-908ee3dc5697
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-init:0.1@sha256:8c06b307b7f74622503b80ff0b81ffda63129959f52f8ed8f753d8ab98f38411
          kind: Task
          name: init
        status:
          completionTime: '2023-04-13T14:21:51Z'
          conditions:
            - lastTransitionTime: '2023-04-13T14:21:51Z'
              message: All Steps have completed executing
              reason: Succeeded
              status: 'True'
              type: Succeeded
          podName: tekton-results-migrator-on-push-xqhhw-init-pod
          startTime: '2023-04-13T14:21:40Z'
          steps:
            - container: step-init
              imageID: >-
                registry.redhat.io/openshift4/ose-tools-rhel8@sha256:4d89da145a14501b049397dc723a2b5feba1f2238c9f71659c9512bd27ca4e95
              name: init
              terminated:
                containerID: >-
                  cri-o://17753cc81d577ca3305be0fffce299a0f77fda86db2ebde6334ed64211122b19
                exitCode: 0
                finishedAt: '2023-04-13T14:21:50Z'
                message: >-
                  [{"key":"build","value":"true","type":1},{"key":"container-registry-secret","value":"tekton-results-migrator-on-push-xqhhw","type":1}]
                reason: Completed
                startedAt: '2023-04-13T14:21:49Z'
          taskResults:
            - name: build
              type: string
              value: 'true'
            - name: container-registry-secret
              type: string
              value: tekton-results-migrator-on-push-xqhhw
          taskSpec:
            description: >-
              Initialize Pipeline Task, include flags for rebuild and auth.
              Generates image repository secret used by the PipelineRun.
            params:
              - description: Image URL for build by PipelineRun
                name: image-url
                type: string
              - default: 'false'
                description: Rebuild the image if exists
                name: rebuild
                type: string
              - default: 'false'
                description: skip checks against built image
                name: skip-checks
                type: string
              - description: >-
                  Name of current pipelinerun, should be
                  "$(context.pipelineRun.name)"
                name: pipelinerun-name
                type: string
              - description: >-
                  UID of current pipelinerun, should be
                  "$(context.pipelineRun.uid)"
                name: pipelinerun-uid
                type: string
              - default: redhat-appstudio-user-workload
                description: >-
                  Shared resource secret for accessing user-workload image
                  repository
                name: shared-secret
                type: string
            results:
              - description: Defines if the image in param image-url should be built
                name: build
                type: string
              - description: Name of secret with credentials
                name: container-registry-secret
                type: string
            steps:
              - env:
                  - name: PIPELINERUN_NAME
                    value: tekton-results-migrator-on-push-xqhhw
                  - name: PIPELINERUN_UID
                    value: ce59052d-9d64-426f-a8e5-908ee3dc5697
                  - name: IMAGE_URL
                    value: >-
                      quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
                  - name: REBUILD
                    value: 'false'
                  - name: SKIP_CHECKS
                    value: 'false'
                image: >-
                  registry.redhat.io/openshift4/ose-tools-rhel8:v4.12@sha256:4d89da145a14501b049397dc723a2b5feba1f2238c9f71659c9512bd27ca4e95
                name: init
                resources: {}
                script: >
                  #!/bin/bash

                  echo "Build Initialize: $IMAGE_URL"

                  echo

                  echo "Create pipelinerun repository secret"

                  SHARED=/secret/default-push-secret/.dockerconfigjson

                  export DOCKER_CONFIG=/tmp/docker/

                  mkdir -p $DOCKER_CONFIG

                  if [ -f $SHARED ]; then
                    jq -M -s '.[0] * .[1]' $SHARED /root/.docker/config.json > $DOCKER_CONFIG/config.json
                  else
                    cp /root/.docker/config.json $DOCKER_CONFIG/config.json
                  fi

                  oc create secret generic
                  --from-file=$DOCKER_CONFIG/config.json $SHARED_PARAM
                  $PIPELINERUN_NAME

                  oc patch secret $PIPELINERUN_NAME -p "{\"metadata\":
                  {\"ownerReferences\": [{\"apiVersion\":
                  \"tekton.dev/v1beta1\", \"blockOwnerDeletion\": false,
                  \"controller\": true, \"kind\": \"PipelineRun\", \"name\":
                  \"$PIPELINERUN_NAME\", \"uid\": \"$PIPELINERUN_UID\" }]}}"

                  echo -n $PIPELINERUN_NAME >
                  /tekton/results/container-registry-secret


                  echo "Determine if Image Already Exists"

                  # Build the image when image does not exists or rebuild is set
                  to true

                  if ! oc image info $IMAGE_URL &>/dev/null || [ "$REBUILD" ==
                  "true" ] || [ "$SKIP_CHECKS" == "false" ]; then
                    echo -n "true" > /tekton/results/build
                  else
                    echo -n "false" > /tekton/results/build
                  fi
                volumeMounts:
                  - mountPath: /secret/default-push-secret
                    name: default-push-secret
            volumes:
              - csi:
                  driver: csi.sharedresource.openshift.io
                  readOnly: true
                  volumeAttributes:
                    sharedSecret: redhat-appstudio-user-workload
                name: default-push-secret
          duration: 11s
          reason: Succeeded
      - name: clone-repository
        params:
          - name: url
            value: 'https://github.com/openshift-pipelines/tektoncd-results'
          - name: revision
            value: 4c93d5c4f34d96d31ade787ee1856d144e342143
        runAfter:
          - init
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-git-clone:0.1@sha256:458f4853a01c3273bd76076ac1b015d5f901e70fb4b776f788b577adb25bf5f8
          kind: Task
          name: git-clone
        when:
          - input: $(tasks.init.results.build)
            operator: in
            values:
              - 'true'
        workspaces:
          - name: output
            workspace: workspace
          - name: basic-auth
            workspace: git-auth
        status:
          completionTime: '2023-04-13T14:22:24Z'
          conditions:
            - lastTransitionTime: '2023-04-13T14:22:24Z'
              message: All Steps have completed executing
              reason: Succeeded
              status: 'True'
              type: Succeeded
          podName: tekton-results-migrator-on-push-xqhhw-clone-repository-pod
          startTime: '2023-04-13T14:22:01Z'
          steps:
            - container: step-clone
              imageID: >-
                registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8@sha256:2fa0b06d52b04f377c696412e19307a9eff27383f81d87aae0b4f71672a1cd0b
              name: clone
              terminated:
                containerID: >-
                  cri-o://08bf335f8e126e39ee4fb42f53b340206670a047b823ce72fdc4f91aedcc5d94
                exitCode: 0
                finishedAt: '2023-04-13T14:22:23Z'
                message: >-
                  [{"key":"commit","value":"4c93d5c4f34d96d31ade787ee1856d144e342143","type":1},{"key":"url","value":"https://github.com/openshift-pipelines/tektoncd-results","type":1}]
                reason: Completed
                startedAt: '2023-04-13T14:22:20Z'
          taskResults:
            - name: commit
              type: string
              value: 4c93d5c4f34d96d31ade787ee1856d144e342143
            - name: url
              type: string
              value: 'https://github.com/openshift-pipelines/tektoncd-results'
          taskSpec:
            description: >-
              The git-clone Task will clone a repo from the provided url into
              the output Workspace. By default the repo will be cloned into the
              root of your Workspace.
            params:
              - description: Repository URL to clone from.
                name: url
                type: string
              - default: ''
                description: 'Revision to checkout. (branch, tag, sha, ref, etc...)'
                name: revision
                type: string
              - default: ''
                description: Refspec to fetch before checking out revision.
                name: refspec
                type: string
              - default: 'true'
                description: Initialize and fetch git submodules.
                name: submodules
                type: string
              - default: '1'
                description: >-
                  Perform a shallow clone, fetching only the most recent N
                  commits.
                name: depth
                type: string
              - default: 'true'
                description: >-
                  Set the `http.sslVerify` global git config. Setting this to
                  `false` is not advised unless you are sure that you trust your
                  git remote.
                name: sslVerify
                type: string
              - default: ''
                description: >-
                  Subdirectory inside the `output` Workspace to clone the repo
                  into.
                name: subdirectory
                type: string
              - default: ''
                description: >-
                  Define the directory patterns to match or exclude when
                  performing a sparse checkout.
                name: sparseCheckoutDirectories
                type: string
              - default: 'true'
                description: >-
                  Clean out the contents of the destination directory if it
                  already exists before cloning.
                name: deleteExisting
                type: string
              - default: ''
                description: HTTP proxy server for non-SSL requests.
                name: httpProxy
                type: string
              - default: ''
                description: HTTPS proxy server for SSL requests.
                name: httpsProxy
                type: string
              - default: ''
                description: Opt out of proxying HTTP/HTTPS requests.
                name: noProxy
                type: string
              - default: 'true'
                description: >-
                  Log the commands that are executed during `git-clone`'s
                  operation.
                name: verbose
                type: string
              - default: >-
                  registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8:v1.8.2-8@sha256:a538c423e7a11aae6ae582a411fdb090936458075f99af4ce5add038bb6983e8
                description: The image providing the git-init binary that this Task runs.
                name: gitInitImage
                type: string
              - default: /tekton/home
                description: >
                  Absolute path to the user's home directory. Set this
                  explicitly if you are running the image as a non-root user or
                  have overridden

                  the gitInitImage param with an image containing custom user
                  configuration.
                name: userHome
                type: string
            results:
              - description: The precise commit SHA that was fetched by this Task.
                name: commit
                type: string
              - description: The precise URL that was fetched by this Task.
                name: url
                type: string
            steps:
              - env:
                  - name: HOME
                    value: /tekton/home
                  - name: PARAM_URL
                    value: 'https://github.com/openshift-pipelines/tektoncd-results'
                  - name: PARAM_REVISION
                    value: 4c93d5c4f34d96d31ade787ee1856d144e342143
                  - name: PARAM_REFSPEC
                  - name: PARAM_SUBMODULES
                    value: 'true'
                  - name: PARAM_DEPTH
                    value: '1'
                  - name: PARAM_SSL_VERIFY
                    value: 'true'
                  - name: PARAM_SUBDIRECTORY
                  - name: PARAM_DELETE_EXISTING
                    value: 'true'
                  - name: PARAM_HTTP_PROXY
                  - name: PARAM_HTTPS_PROXY
                  - name: PARAM_NO_PROXY
                  - name: PARAM_VERBOSE
                    value: 'true'
                  - name: PARAM_SPARSE_CHECKOUT_DIRECTORIES
                  - name: PARAM_USER_HOME
                    value: /tekton/home
                  - name: WORKSPACE_OUTPUT_PATH
                    value: /workspace/output
                  - name: WORKSPACE_SSH_DIRECTORY_BOUND
                    value: 'false'
                  - name: WORKSPACE_SSH_DIRECTORY_PATH
                  - name: WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND
                    value: 'false'
                  - name: WORKSPACE_BASIC_AUTH_DIRECTORY_PATH
                image: >-
                  registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8:v1.8.2-8@sha256:a538c423e7a11aae6ae582a411fdb090936458075f99af4ce5add038bb6983e8
                name: clone
                resources: {}
                script: >
                  #!/usr/bin/env sh

                  set -eu


                  if [ "${PARAM_VERBOSE}" = "true" ] ; then
                    set -x
                  fi


                  if [ "${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}" = "true" ] ;
                  then
                    cp "${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials" "${PARAM_USER_HOME}/.git-credentials"
                    cp "${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig" "${PARAM_USER_HOME}/.gitconfig"
                    chmod 400 "${PARAM_USER_HOME}/.git-credentials"
                    chmod 400 "${PARAM_USER_HOME}/.gitconfig"
                  fi


                  if [ "${WORKSPACE_SSH_DIRECTORY_BOUND}" = "true" ] ; then
                    cp -R "${WORKSPACE_SSH_DIRECTORY_PATH}" "${PARAM_USER_HOME}"/.ssh
                    chmod 700 "${PARAM_USER_HOME}"/.ssh
                    chmod -R 400 "${PARAM_USER_HOME}"/.ssh/*
                  fi


                  CHECKOUT_DIR="${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}"


                  cleandir() {
                    # Delete any existing contents of the repo directory if it exists.
                    #
                    # We don't just "rm -rf ${CHECKOUT_DIR}" because ${CHECKOUT_DIR} might be "/"
                    # or the root of a mounted volume.
                    if [ -d "${CHECKOUT_DIR}" ] ; then
                      # Delete non-hidden files and directories
                      rm -rf "${CHECKOUT_DIR:?}"/*
                      # Delete files and directories starting with . but excluding ..
                      rm -rf "${CHECKOUT_DIR}"/.[!.]*
                      # Delete files and directories starting with .. plus any other character
                      rm -rf "${CHECKOUT_DIR}"/..?*
                    fi
                  }


                  if [ "${PARAM_DELETE_EXISTING}" = "true" ] ; then
                    cleandir
                  fi


                  test -z "${PARAM_HTTP_PROXY}" || export
                  HTTP_PROXY="${PARAM_HTTP_PROXY}"

                  test -z "${PARAM_HTTPS_PROXY}" || export
                  HTTPS_PROXY="${PARAM_HTTPS_PROXY}"

                  test -z "${PARAM_NO_PROXY}" || export
                  NO_PROXY="${PARAM_NO_PROXY}"


                  /ko-app/git-init \
                    -url="${PARAM_URL}" \
                    -revision="${PARAM_REVISION}" \
                    -refspec="${PARAM_REFSPEC}" \
                    -path="${CHECKOUT_DIR}" \
                    -sslVerify="${PARAM_SSL_VERIFY}" \
                    -submodules="${PARAM_SUBMODULES}" \
                    -depth="${PARAM_DEPTH}" \
                    -sparseCheckoutDirectories="${PARAM_SPARSE_CHECKOUT_DIRECTORIES}"
                  cd "${CHECKOUT_DIR}"

                  RESULT_SHA="$(git rev-parse HEAD)"

                  EXIT_CODE="$?"

                  if [ "${EXIT_CODE}" != 0 ] ; then
                    exit "${EXIT_CODE}"
                  fi

                  printf "%s" "${RESULT_SHA}" > "/tekton/results/commit"

                  printf "%s" "${PARAM_URL}" > "/tekton/results/url"
                securityContext:
                  runAsUser: 0
            workspaces:
              - description: >-
                  The git repo will be cloned onto the volume backing this
                  Workspace.
                name: output
              - description: >
                  A .ssh directory with private key, known_hosts, config, etc.
                  Copied to

                  the user's home before git commands are executed. Used to
                  authenticate

                  with the git remote when performing the clone. Binding a
                  Secret to this

                  Workspace is strongly recommended over other volume types.
                name: ssh-directory
                optional: true
              - description: >
                  A Workspace containing a .gitconfig and .git-credentials file.
                  These

                  will be copied to the user's home before any git commands are
                  run. Any

                  other files in this Workspace are ignored. It is strongly
                  recommended

                  to use ssh-directory over basic-auth whenever possible and to
                  bind a

                  Secret to this Workspace over other volume types.
                name: basic-auth
                optional: true
          duration: 23s
          reason: Succeeded
      - name: prefetch-dependencies
        params:
          - name: input
            value: ''
        runAfter:
          - clone-repository
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-prefetch-dependencies:0.1@sha256:609f5c2a0d72dddb193a0fc2aef2390601172d09f093deadfb9827e28e8dea30
          kind: Task
          name: prefetch-dependencies
        when:
          - input: 'false'
            operator: in
            values:
              - 'true'
        workspaces:
          - name: source
            workspace: workspace
        status:
          reason: Skipped
      - name: build-container
        params:
          - name: IMAGE
            value: >-
              quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
          - name: DOCKERFILE
            value: images/migrator/Dockerfile
          - name: CONTEXT
            value: .
          - name: DOCKER_AUTH
            value: $(tasks.init.results.container-registry-secret)
          - name: HERMETIC
            value: 'false'
          - name: PREFETCH_INPUT
            value: ''
        runAfter:
          - prefetch-dependencies
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-buildah:0.1@sha256:f4c4c211a7b8c859fb23d9b01faaf1a995a33b243476a617370e35f6438096e0
          kind: Task
          name: buildah
        when:
          - input: $(tasks.init.results.build)
            operator: in
            values:
              - 'true'
        workspaces:
          - name: source
            workspace: workspace
        status:
          completionTime: '2023-04-13T14:24:56Z'
          conditions:
            - lastTransitionTime: '2023-04-13T14:24:56Z'
              message: All Steps have completed executing
              reason: Succeeded
              status: 'True'
              type: Succeeded
          podName: tekton-results-migrator-on-push-xqhhw-build-container-pod
          startTime: '2023-04-13T14:22:31Z'
          steps:
            - container: step-build
              imageID: >-
                quay.io/redhat-appstudio/buildah@sha256:381e9bfedd59701477621da93892106873a6951b196105d3d2d85c3f6d7b569b
              name: build
              terminated:
                containerID: >-
                  cri-o://6e53211b488a1e5c0ee79c39b01f7990731eb13a16a04b8c2e5e83e2c6e2da5e
                exitCode: 0
                finishedAt: '2023-04-13T14:24:35Z'
                reason: Completed
                startedAt: '2023-04-13T14:22:50Z'
            - container: step-sbom-get
              imageID: >-
                quay.io/redhat-appstudio/syft@sha256:09afc449976230f66848c19bb5ccf344eb0eeb4ed50747e33b53aff49462c319
              name: sbom-get
              terminated:
                containerID: >-
                  cri-o://cf9fb7b819a59491cf941c6dd1b1fb2ef17251e0f352fc9dce4aecb9e30323b6
                exitCode: 0
                finishedAt: '2023-04-13T14:24:43Z'
                reason: Completed
                startedAt: '2023-04-13T14:24:36Z'
            - container: step-analyse-dependencies-java-sbom
              imageID: >-
                quay.io/redhat-appstudio/hacbs-jvm-build-request-processor@sha256:b198cf4b33dab59ce8ac25afd4e1001390db29ca2dec83dc8a1e21b0359ce743
              name: analyse-dependencies-java-sbom
              terminated:
                containerID: >-
                  cri-o://d9fa35211ee2778a9fbeaa4e88e4239af42bf55c95613b1f3512274ae4ce376f
                exitCode: 0
                finishedAt: '2023-04-13T14:24:44Z'
                message: '[{"key":"JAVA_COMMUNITY_DEPENDENCIES","value":"","type":1}]'
                reason: Completed
                startedAt: '2023-04-13T14:24:44Z'
            - container: step-merge-sboms
              imageID: >-
                registry.access.redhat.com/ubi9/python-39@sha256:89463fe3e086620617a4f6281640469ba7a7abd2f1b5be13e6cf0f46a6565516
              name: merge-sboms
              terminated:
                containerID: >-
                  cri-o://bf0ddae6ba313c10feb951dbeee1e02a2b4d5c3173b6b50368fedf590a0f5adf
                exitCode: 0
                finishedAt: '2023-04-13T14:24:45Z'
                message: '[{"key":"JAVA_COMMUNITY_DEPENDENCIES","value":"","type":1}]'
                reason: Completed
                startedAt: '2023-04-13T14:24:45Z'
            - container: step-inject-sbom-and-push
              imageID: >-
                registry.access.redhat.com/ubi9/buildah@sha256:c8b1d312815452964885680fc5bc8d99b3bfe9b6961228c71a09c72ca8e915eb
              name: inject-sbom-and-push
              terminated:
                containerID: >-
                  cri-o://e09a40a001889825335acc7378c56122eed4fd08c374ef8edf855a570c274737
                exitCode: 0
                finishedAt: '2023-04-13T14:24:53Z'
                message: >-
                  [{"key":"BASE_IMAGES_DIGESTS","value":"registry.access.redhat.com/ubi9/go-toolset:1.18@sha256:2a518c02504b95202eaccfc5f987854c641ffa215dc379b5205e88260b15970e\nregistry.access.redhat.com/ubi9-minimal:9.1.0@sha256:95413c8dacaac773421428947a431c1cb099d19b4b1125df77d5d1cd2f463ab8\n","type":1},{"key":"IMAGE_DIGEST","value":"sha256:f489d25fd3500e58d7eca8f7434a4f9d6e1e9a4c29c10cf36538b23bac987fc9","type":1},{"key":"IMAGE_URL","value":"quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143","type":1},{"key":"JAVA_COMMUNITY_DEPENDENCIES","value":"","type":1}]
                reason: Completed
                startedAt: '2023-04-13T14:24:46Z'
            - container: step-upload-sbom
              imageID: >-
                quay.io/redhat-appstudio/cosign@sha256:18b3716a6225727877475e1ab4f2493915e72cffd2ce431e9901d2ed2e4b2c0b
              name: upload-sbom
              terminated:
                containerID: >-
                  cri-o://32310e4709851386e052e4a439199a2a41a55a50437d8ba1af65489e15de721d
                exitCode: 0
                finishedAt: '2023-04-13T14:24:55Z'
                message: >-
                  [{"key":"BASE_IMAGES_DIGESTS","value":"registry.access.redhat.com/ubi9/go-toolset:1.18@sha256:2a518c02504b95202eaccfc5f987854c641ffa215dc379b5205e88260b15970e\nregistry.access.redhat.com/ubi9-minimal:9.1.0@sha256:95413c8dacaac773421428947a431c1cb099d19b4b1125df77d5d1cd2f463ab8\n","type":1},{"key":"IMAGE_DIGEST","value":"sha256:f489d25fd3500e58d7eca8f7434a4f9d6e1e9a4c29c10cf36538b23bac987fc9","type":1},{"key":"IMAGE_URL","value":"quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143","type":1},{"key":"JAVA_COMMUNITY_DEPENDENCIES","value":"","type":1}]
                reason: Completed
                startedAt: '2023-04-13T14:24:54Z'
          taskResults:
            - name: JAVA_COMMUNITY_DEPENDENCIES
              type: string
              value: ''
            - name: BASE_IMAGES_DIGESTS
              type: string
              value: >
                registry.access.redhat.com/ubi9/go-toolset:1.18@sha256:2a518c02504b95202eaccfc5f987854c641ffa215dc379b5205e88260b15970e

                registry.access.redhat.com/ubi9-minimal:9.1.0@sha256:95413c8dacaac773421428947a431c1cb099d19b4b1125df77d5d1cd2f463ab8
            - name: IMAGE_DIGEST
              type: string
              value: >-
                sha256:f489d25fd3500e58d7eca8f7434a4f9d6e1e9a4c29c10cf36538b23bac987fc9
            - name: IMAGE_URL
              type: string
              value: >-
                quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
          taskSpec:
            description: >-
              Buildah task builds source code into a container image and pushes
              the image into container registry using buildah tool.

              In addition it generates a SBOM file, injects the SBOM file into
              final container image and pushes the SBOM file as separate image
              using cosign tool.

              When [Java dependency
              rebuild](https://redhat-appstudio.github.io/docs.stonesoup.io/Documentation/main/cli/proc_enabled_java_dependencies.html)
              is enabled it triggers rebuilds of Java artifacts.

              When prefetch-dependencies task was activated it is using its
              artifacts to run build in hermetic environment.
            params:
              - description: Reference of the image buildah will produce.
                name: IMAGE
                type: string
              - default: >-
                  registry.access.redhat.com/ubi9/buildah:9.0.0-19@sha256:c8b1d312815452964885680fc5bc8d99b3bfe9b6961228c71a09c72ca8e915eb
                description: The location of the buildah builder image.
                name: BUILDER_IMAGE
                type: string
              - default: ./Dockerfile
                description: Path to the Dockerfile to build.
                name: DOCKERFILE
                type: string
              - default: .
                description: Path to the directory to use as context.
                name: CONTEXT
                type: string
              - default: 'true'
                description: >-
                  Verify the TLS on the registry endpoint (for push/pull to a
                  non-TLS registry)
                name: TLSVERIFY
                type: string
              - description: secret with config.json for container auth
                name: DOCKER_AUTH
                type: string
              - default: 'false'
                description: Determines if build will be executed without network access.
                name: HERMETIC
                type: string
              - default: ''
                description: >-
                  In case it is not empty, the prefetched content should be made
                  available to the build.
                name: PREFETCH_INPUT
                type: string
            results:
              - description: Digest of the image just built
                name: IMAGE_DIGEST
                type: string
              - description: Image repository where the built image was pushed
                name: IMAGE_URL
                type: string
              - description: Digests of the base images used for build
                name: BASE_IMAGES_DIGESTS
                type: string
              - description: The counting of Java components by publisher in JSON format
                name: SBOM_JAVA_COMPONENTS_COUNT
                type: string
              - description: >-
                  The Java dependencies that came from community sources such as
                  Maven central.
                name: JAVA_COMMUNITY_DEPENDENCIES
                type: string
            stepTemplate:
              env:
                - name: BUILDAH_FORMAT
                  value: oci
                - name: STORAGE_DRIVER
                  value: vfs
                - name: HERMETIC
                  value: 'false'
                - name: PREFETCH_INPUT
                - name: DOCKER_CONFIG
                  value: /secrets/registry-auth
                - name: CONTEXT
                  value: .
                - name: DOCKERFILE
                  value: images/migrator/Dockerfile
                - name: IMAGE
                  value: >-
                    quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
                - name: TLSVERIFY
                  value: 'true'
              name: ''
              resources: {}
            steps:
              - image: 'quay.io/redhat-appstudio/buildah:v1.28'
                name: build
                resources:
                  limits:
                    cpu: '2'
                    memory: 4Gi
                  requests:
                    cpu: 10m
                    memory: 512Mi
                script: >
                  if [ -e "$CONTEXT/$DOCKERFILE" ]; then
                    dockerfile_path="$CONTEXT/$DOCKERFILE"
                  elif [ -e "$DOCKERFILE" ]; then
                    dockerfile_path="$DOCKERFILE"
                  elif echo "$DOCKERFILE" | grep -q "^https\?://"; then
                    echo "Fetch Dockerfile from $DOCKERFILE"
                    dockerfile_path=$(mktemp --suffix=-Dockerfile)
                    http_code=$(curl -s -L -w "%{http_code}" --output "$dockerfile_path" "$DOCKERFILE")
                    if [ $http_code != 200 ]; then
                      echo "No Dockerfile is fetched. Server responds $http_code"
                      exit 1
                    fi
                    http_code=$(curl -s -L -w "%{http_code}" --output "$dockerfile_path.dockerignore.tmp" "$DOCKERFILE.dockerignore")
                    if [ $http_code = 200 ]; then
                      echo "Fetched .dockerignore from $DOCKERFILE.dockerignore"
                      mv "$dockerfile_path.dockerignore.tmp" $CONTEXT/.dockerignore
                    fi
                  else
                    echo "Cannot find Dockerfile $DOCKERFILE"
                    exit 1
                  fi

                  if [ -n "$JVM_BUILD_WORKSPACE_ARTIFACT_CACHE_PORT_80_TCP_ADDR"
                  ] && grep -q '^\s*RUN \(./\)\?mvn' "$dockerfile_path"; then
                    sed -i -e "s|^\s*RUN \(\(./\)\?mvn\(.*\)\)|RUN echo \"<settings><mirrors><mirror><id>mirror.default</id><url>http://$JVM_BUILD_WORKSPACE_ARTIFACT_CACHE_PORT_80_TCP_ADDR/v1/cache/default/0/</url><mirrorOf>*</mirrorOf></mirror></mirrors></settings>\" > /tmp/settings.yaml; \1 -s /tmp/settings.yaml|g" "$dockerfile_path"
                    touch /var/lib/containers/java
                  fi



                  sed -i 's/^\s*short-name-mode\s*=\s*.*/short-name-mode =
                  "disabled"/' /etc/containers/registries.conf


                  # Setting new namespace to run buildah - 2^32-2

                  echo 'root:1:4294967294' | tee -a /etc/subuid >> /etc/subgid


                  if [ "${HERMETIC}" == "true" ]; then
                    BUILDAH_ARGS="--pull=never"
                    UNSHARE_ARGS="--net"
                    for image in $(grep -i '^\s*FROM' "$dockerfile_path" | sed 's/--platform=\S*//' | awk '{print $2}'); do
                      unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -- buildah pull $image
                    done
                    echo "Build will be executed with network isolation"
                  fi


                  if [ -n "${PREFETCH_INPUT}" ]; then
                    mv cachi2 /tmp/
                    chmod -R go+rwX /tmp/cachi2
                    VOLUME_MOUNTS="--volume /tmp/cachi2:/cachi2"
                    sed -i 's|^\s*run |RUN . /cachi2/cachi2.env \&\& \\\n    |i' "$dockerfile_path"
                    echo "Prefetched content will be made available"
                  fi


                  unshare -Uf $UNSHARE_ARGS --keep-caps -r --map-users 1,1,65536
                  --map-groups 1,1,65536 -- buildah bud \
                    $VOLUME_MOUNTS \
                    $BUILDAH_ARGS \
                    --tls-verify=$TLSVERIFY --no-cache \
                    --ulimit nofile=4096:4096 \
                    -f "$dockerfile_path" -t $IMAGE $CONTEXT

                  container=$(buildah from --pull-never $IMAGE)

                  buildah mount $container | tee /workspace/container_path

                  echo $container > /workspace/container_name
                securityContext:
                  capabilities:
                    add:
                      - SETFCAP
                volumeMounts:
                  - mountPath: /var/lib/containers
                    name: varlibcontainers
                  - mountPath: /secrets/registry-auth
                    name: registry-auth
                workingDir: /workspace/source
              - image: 'quay.io/redhat-appstudio/syft:v0.47.0'
                name: sbom-get
                resources: {}
                script: >
                  syft dir:/workspace/source
                  --file=/workspace/source/sbom-source.json
                  --output=cyclonedx-json

                  find $(cat /workspace/container_path) -xtype l -delete

                  syft dir:$(cat /workspace/container_path)
                  --file=/workspace/source/sbom-image.json
                  --output=cyclonedx-json
                volumeMounts:
                  - mountPath: /var/lib/containers
                    name: varlibcontainers
              - image: >-
                  quay.io/redhat-appstudio/hacbs-jvm-build-request-processor:1d417e6f1f3e68c6c537333b5759796eddae0afc
                name: analyse-dependencies-java-sbom
                resources: {}
                script: |
                  if [ -f /var/lib/containers/java ]; then
                    /opt/jboss/container/java/run/run-java.sh analyse-dependencies path $(cat /workspace/container_path) -s /workspace/source/sbom-image.json --task-run-name tekton-results-migrator-on-push-xqhhw-build-container --publishers /tekton/results/SBOM_JAVA_COMPONENTS_COUNT
                    sed -i 's/^/ /' /tekton/results/SBOM_JAVA_COMPONENTS_COUNT # Workaround for SRVKP-2875
                  else
                    touch /tekton/results/JAVA_COMMUNITY_DEPENDENCIES
                  fi
                securityContext:
                  runAsUser: 0
                volumeMounts:
                  - mountPath: /var/lib/containers
                    name: varlibcontainers
              - image: 'registry.access.redhat.com/ubi9/python-39:1-108'
                name: merge-sboms
                resources: {}
                script: >
                  #!/bin/python3

                  import json

                  import os


                  # load SBOMs

                  with open("./sbom-image.json") as f:
                    image_sbom = json.load(f)

                  with open("./sbom-source.json") as f:
                    source_sbom = json.load(f)

                  # fetch unique components from available SBOMs

                  def get_identifier(component):
                    return component["name"] + '@' + component.get("version", "")

                  existing_components = [get_identifier(component) for component
                  in image_sbom["components"]]


                  for component in source_sbom["components"]:
                    if get_identifier(component) not in existing_components:
                      image_sbom["components"].append(component)
                      existing_components.append(get_identifier(component))

                  image_sbom["components"].sort(key=lambda c: get_identifier(c))


                  # write the CycloneDX unified SBOM

                  with open("./sbom-cyclonedx.json", "w") as f:
                    json.dump(image_sbom, f, indent=4)

                  # create and write the PURL unified SBOM

                  purls = [{"purl": component["purl"]} for component in
                  image_sbom["components"] if "purl" in component]

                  purl_content = {"image_contents": {"dependencies": purls}}


                  with open("sbom-purl.json", "w") as output_file:
                    json.dump(purl_content, output_file, indent=4)
                securityContext:
                  runAsUser: 0
                workingDir: /workspace/source
              - image: >-
                  registry.access.redhat.com/ubi9/buildah:9.0.0-19@sha256:c8b1d312815452964885680fc5bc8d99b3bfe9b6961228c71a09c72ca8e915eb
                name: inject-sbom-and-push
                resources: {}
                script: >
                  # Expose base image digests

                  buildah images --format '{{ .Name }}:{{ .Tag }}@{{ .Digest }}'
                  | grep -v $IMAGE > /tekton/results/BASE_IMAGES_DIGESTS


                  base_image_name=$(buildah inspect --format '{{ index
                  .ImageAnnotations "org.opencontainers.image.base.name"}}'
                  $IMAGE)

                  base_image_digest=$(buildah inspect --format '{{ index
                  .ImageAnnotations "org.opencontainers.image.base.digest"}}'
                  $IMAGE)

                  container=$(buildah from --pull-never $IMAGE)

                  buildah copy $container sbom-cyclonedx.json sbom-purl.json
                  /root/buildinfo/content_manifests/

                  buildah config -a
                  org.opencontainers.image.base.name=${base_image_name} -a
                  org.opencontainers.image.base.digest=${base_image_digest}
                  $container

                  buildah commit $container $IMAGE

                  buildah push \
                    --tls-verify=$TLSVERIFY \
                    --digestfile /workspace/source/image-digest $IMAGE \
                    docker://$IMAGE
                  cat "/workspace/source"/image-digest | tee
                  /tekton/results/IMAGE_DIGEST

                  echo -n "$IMAGE" | tee /tekton/results/IMAGE_URL
                securityContext:
                  capabilities:
                    add:
                      - SETFCAP
                  runAsUser: 0
                volumeMounts:
                  - mountPath: /var/lib/containers
                    name: varlibcontainers
                  - mountPath: /secrets/registry-auth
                    name: registry-auth
                workingDir: /workspace/source
              - args:
                  - attach
                  - sbom
                  - '--sbom'
                  - sbom-cyclonedx.json
                  - '--type'
                  - cyclonedx
                  - >-
                    quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
                image: 'quay.io/redhat-appstudio/cosign:v1.13.1'
                name: upload-sbom
                resources: {}
                volumeMounts:
                  - mountPath: /secrets/registry-auth
                    name: registry-auth
                workingDir: /workspace/source
            volumes:
              - emptyDir: {}
                name: varlibcontainers
              - name: registry-auth
                secret:
                  optional: true
                  secretName: tekton-results-migrator-on-push-xqhhw
            workspaces:
              - description: Workspace containing the source code to build.
                name: source
          duration: 2m 25s
          reason: Succeeded
      - name: inspect-image
        params:
          - name: IMAGE_URL
            value: $(tasks.build-container.results.IMAGE_URL)
          - name: IMAGE_DIGEST
            value: $(tasks.build-container.results.IMAGE_DIGEST)
          - name: DOCKER_AUTH
            value: $(tasks.init.results.container-registry-secret)
        runAfter:
          - build-container
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-inspect-image:0.1@sha256:5531128863a2ac4129680d8bc5ed8ea20960c6f3a3731a561feb47afb7db8fcb
          kind: Task
          name: inspect-image
        when:
          - input: 'false'
            operator: in
            values:
              - 'false'
        workspaces:
          - name: source
            workspace: workspace
        status:
          reason: Cancelled
      - name: label-check
        runAfter:
          - inspect-image
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-label-check:0.1@sha256:2cabc7f183c5f089b827a5ac2450fef80be325480fbd2fb322ddb1e0feeb5f7d
          kind: Task
          name: label-check
        when:
          - input: 'false'
            operator: in
            values:
              - 'false'
        workspaces:
          - name: workspace
            workspace: workspace
        status:
          reason: Cancelled
      - name: optional-label-check
        params:
          - name: POLICY_NAMESPACE
            value: optional_checks
        runAfter:
          - inspect-image
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-label-check:0.1@sha256:2cabc7f183c5f089b827a5ac2450fef80be325480fbd2fb322ddb1e0feeb5f7d
          kind: Task
          name: label-check
        when:
          - input: 'false'
            operator: in
            values:
              - 'false'
        workspaces:
          - name: workspace
            workspace: workspace
        status:
          reason: Cancelled
      - name: deprecated-base-image-check
        params:
          - name: BASE_IMAGES_DIGESTS
            value: $(tasks.build-container.results.BASE_IMAGES_DIGESTS)
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-deprecated-image-check:0.2@sha256:bf1a1cad85bb896e920f0f7ff5dda2f885b76f2617934f72e7954565cd50df49
          kind: Task
          name: deprecated-image-check
        when:
          - input: 'false'
            operator: in
            values:
              - 'false'
        workspaces:
          - name: test-ws
            workspace: workspace
        status:
          reason: Cancelled
      - name: clair-scan
        params:
          - name: image-digest
            value: $(tasks.build-container.results.IMAGE_DIGEST)
          - name: image-url
            value: $(tasks.build-container.results.IMAGE_URL)
          - name: docker-auth
            value: $(tasks.init.results.container-registry-secret)
        runAfter:
          - build-container
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-clair-scan:0.1@sha256:1b4951e91fdfb3188d459d0abac411a6364da5cb135e81fb4a84bbd782bb545d
          kind: Task
          name: clair-scan
        when:
          - input: 'false'
            operator: in
            values:
              - 'false'
        status:
          reason: Cancelled
      - name: sast-snyk-check
        params:
          - name: SNYK_SECRET
            value: snyk-shared-secret
        runAfter:
          - clone-repository
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-sast-snyk-check:0.1@sha256:58f288a86ae7e1a2fff416d11720521effcf8e9b410355080a2b8a9bb8ae587c
          kind: Task
          name: sast-snyk-check
        when:
          - input: 'false'
            operator: in
            values:
              - 'false'
          - input: snyk-shared-secret
            operator: notin
            values:
              - ''
        workspaces:
          - name: workspace
            workspace: workspace
        status:
          completionTime: '2023-04-13T14:22:47Z'
          conditions:
            - lastTransitionTime: '2023-04-13T14:22:47Z'
              message: All Steps have completed executing
              reason: Succeeded
              status: 'True'
              type: Succeeded
          podName: tekton-results-migrator-on-push-xqhhw-sast-snyk-check-pod
          startTime: '2023-04-13T14:22:32Z'
          steps:
            - container: step-sast-snyk-check
              imageID: >-
                quay.io/redhat-appstudio/hacbs-test@sha256:853d6196d89e99da75abe5454ed969abc304f0647b113fa81a40fea2a3026d31
              name: sast-snyk-check
              terminated:
                containerID: >-
                  cri-o://61a0b6012a4e22e3713b834cd221bbc2d6a7e01229ade4e387883177d4e97ee4
                exitCode: 0
                finishedAt: '2023-04-13T14:22:46Z'
                reason: Completed
                startedAt: '2023-04-13T14:22:46Z'
          taskSpec:
            description: >-
              Scans source code for security vulnerabilities, including common
              issues such as SQL injection, cross-site scripting (XSS), and code
              injection attacks using Snyk Code, a Static Application Security
              Testing (SAST) tool.
            params:
              - default: ''
                description: Name of secret which contains Snyk token.
                name: SNYK_SECRET
                type: string
              - default: '--all-projects --exclude=test*,vendor,deps'
                description: Append arguments.
                name: ARGS
                type: string
            results:
              - description: Tekton task test output.
                name: HACBS_TEST_OUTPUT
                type: string
            steps:
              - env:
                  - name: SNYK_SECRET
                    value: snyk-shared-secret
                  - name: ARGS
                    value: '--all-projects --exclude=test*,vendor,deps'
                image: >-
                  quay.io/redhat-appstudio/hacbs-test:v1.0.12@sha256:8c833349cad40d34262548295cd4eb1bd330e42fbb221ef54e6caee15ae1d208
                name: sast-snyk-check
                resources: {}
                script: >
                  #!/usr/bin/env bash

                  . /utils.sh

                  SNYK_TOKEN="$(cat /etc/secrets/snyk_token)"

                  if [[ -z $SNYK_TOKEN ]]; then
                    echo "SNYK_TOKEN not defined. Create $SNYK_SECRET secret with key containing Snyk token." | tee stdout.txt
                    note="Task sast-snyk-check skipped: SNYK_TOKEN is empty."
                    HACBS_TEST_OUTPUT=$(make_result_json -r SKIPPED -t "$note")
                    exit 0
                  fi

                  export SNYK_TOKEN

                  SNYK_EXIT_CODE=0

                  snyk code test $ARGS ../..
                  --sarif-file-output=sast_snyk_check_out.json 1>&2>> stdout.txt
                  || SNYK_EXIT_CODE=$?

                  test_not_skipped=0

                  SKIP_MSG="We found 0 supported files"

                  grep -q "$SKIP_MSG" stdout.txt || test_not_skipped=$?


                  if [[ "$SNYK_EXIT_CODE" -eq 0 ]] || [[ "$SNYK_EXIT_CODE" -eq 1
                  ]]; then
                    cat sast_snyk_check_out.json
                    HACBS_TEST_OUTPUT=
                    parse_hacbs_test_output sast-snyk-check sarif sast_snyk_check_out.json  || true

                  # When the test is skipped, the "SNYK_EXIT_CODE" is 3 and it
                  can also be 3 in some other situation

                  elif [[ "$test_not_skipped" -eq 0 ]]; then
                    note="Task sast-snyk-check skipped: Snyk code test found zero supported files."
                    HACBS_ERROR_OUTPUT=$(make_result_json -r SKIPPED -t "$note")
                  else
                    echo "sast-snyk-check test failed because of the following issues:"
                    cat stdout.txt
                    note="Task sast-snyk-check failed: For details, check Tekton task log."
                    HACBS_ERROR_OUTPUT=$(make_result_json -r ERROR -t "$note")
                  fi

                  echo "${HACBS_TEST_OUTPUT:-${HACBS_ERROR_OUTPUT}}" | tee
                  /tekton/results/HACBS_TEST_OUTPUT
                volumeMounts:
                  - mountPath: /etc/secrets
                    name: snyk-secret
                    readOnly: true
                workingDir: /workspace/workspace/hacbs/sast-snyk-check
            volumes:
              - name: snyk-secret
                secret:
                  optional: true
                  secretName: snyk-shared-secret
            workspaces:
              - name: workspace
          duration: 15s
          reason: Succeeded
      - name: clamav-scan
        params:
          - name: image-digest
            value: $(tasks.build-container.results.IMAGE_DIGEST)
          - name: image-url
            value: $(tasks.build-container.results.IMAGE_URL)
          - name: docker-auth
            value: $(tasks.init.results.container-registry-secret)
        runAfter:
          - build-container
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-clamav-scan:0.1@sha256:2c8dbe8aa7c0fa126a9c84e7590c4e901bcfeec6dde4ccbffda4c493cefb43ed
          kind: Task
          name: clamav-scan
        when:
          - input: 'false'
            operator: in
            values:
              - 'false'
        status:
          reason: Cancelled
      - name: sbom-json-check
        params:
          - name: IMAGE_URL
            value: $(tasks.build-container.results.IMAGE_URL)
          - name: IMAGE_DIGEST
            value: $(tasks.build-container.results.IMAGE_DIGEST)
        runAfter:
          - build-container
        taskRef:
          bundle: >-
            quay.io/redhat-appstudio-tekton-catalog/task-sbom-json-check:0.1@sha256:9a232f343d6397bfaf9620b6e63ce6943e256ad30da93cf8e9de3ca63ada7717
          kind: Task
          name: sbom-json-check
        when:
          - input: 'false'
            operator: in
            values:
              - 'false'
        status:
          reason: Cancelled
    workspaces:
      - name: workspace
      - name: git-auth
        optional: true
  skippedTasks:
    - name: prefetch-dependencies
      reason: When Expressions evaluated to false
      whenExpressions:
        - input: 'false'
          operator: in
          values:
            - 'true'
  startTime: '2023-04-13T14:21:34Z'
  taskRuns:
    tekton-results-migrator-on-push-xqhhw-build-container:
      pipelineTaskName: build-container
      status:
        completionTime: '2023-04-13T14:24:56Z'
        conditions:
          - lastTransitionTime: '2023-04-13T14:24:56Z'
            message: All Steps have completed executing
            reason: Succeeded
            status: 'True'
            type: Succeeded
        podName: tekton-results-migrator-on-push-xqhhw-build-container-pod
        startTime: '2023-04-13T14:22:31Z'
        steps:
          - container: step-build
            imageID: >-
              quay.io/redhat-appstudio/buildah@sha256:381e9bfedd59701477621da93892106873a6951b196105d3d2d85c3f6d7b569b
            name: build
            terminated:
              containerID: >-
                cri-o://6e53211b488a1e5c0ee79c39b01f7990731eb13a16a04b8c2e5e83e2c6e2da5e
              exitCode: 0
              finishedAt: '2023-04-13T14:24:35Z'
              reason: Completed
              startedAt: '2023-04-13T14:22:50Z'
          - container: step-sbom-get
            imageID: >-
              quay.io/redhat-appstudio/syft@sha256:09afc449976230f66848c19bb5ccf344eb0eeb4ed50747e33b53aff49462c319
            name: sbom-get
            terminated:
              containerID: >-
                cri-o://cf9fb7b819a59491cf941c6dd1b1fb2ef17251e0f352fc9dce4aecb9e30323b6
              exitCode: 0
              finishedAt: '2023-04-13T14:24:43Z'
              reason: Completed
              startedAt: '2023-04-13T14:24:36Z'
          - container: step-analyse-dependencies-java-sbom
            imageID: >-
              quay.io/redhat-appstudio/hacbs-jvm-build-request-processor@sha256:b198cf4b33dab59ce8ac25afd4e1001390db29ca2dec83dc8a1e21b0359ce743
            name: analyse-dependencies-java-sbom
            terminated:
              containerID: >-
                cri-o://d9fa35211ee2778a9fbeaa4e88e4239af42bf55c95613b1f3512274ae4ce376f
              exitCode: 0
              finishedAt: '2023-04-13T14:24:44Z'
              message: '[{"key":"JAVA_COMMUNITY_DEPENDENCIES","value":"","type":1}]'
              reason: Completed
              startedAt: '2023-04-13T14:24:44Z'
          - container: step-merge-sboms
            imageID: >-
              registry.access.redhat.com/ubi9/python-39@sha256:89463fe3e086620617a4f6281640469ba7a7abd2f1b5be13e6cf0f46a6565516
            name: merge-sboms
            terminated:
              containerID: >-
                cri-o://bf0ddae6ba313c10feb951dbeee1e02a2b4d5c3173b6b50368fedf590a0f5adf
              exitCode: 0
              finishedAt: '2023-04-13T14:24:45Z'
              message: '[{"key":"JAVA_COMMUNITY_DEPENDENCIES","value":"","type":1}]'
              reason: Completed
              startedAt: '2023-04-13T14:24:45Z'
          - container: step-inject-sbom-and-push
            imageID: >-
              registry.access.redhat.com/ubi9/buildah@sha256:c8b1d312815452964885680fc5bc8d99b3bfe9b6961228c71a09c72ca8e915eb
            name: inject-sbom-and-push
            terminated:
              containerID: >-
                cri-o://e09a40a001889825335acc7378c56122eed4fd08c374ef8edf855a570c274737
              exitCode: 0
              finishedAt: '2023-04-13T14:24:53Z'
              message: >-
                [{"key":"BASE_IMAGES_DIGESTS","value":"registry.access.redhat.com/ubi9/go-toolset:1.18@sha256:2a518c02504b95202eaccfc5f987854c641ffa215dc379b5205e88260b15970e\nregistry.access.redhat.com/ubi9-minimal:9.1.0@sha256:95413c8dacaac773421428947a431c1cb099d19b4b1125df77d5d1cd2f463ab8\n","type":1},{"key":"IMAGE_DIGEST","value":"sha256:f489d25fd3500e58d7eca8f7434a4f9d6e1e9a4c29c10cf36538b23bac987fc9","type":1},{"key":"IMAGE_URL","value":"quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143","type":1},{"key":"JAVA_COMMUNITY_DEPENDENCIES","value":"","type":1}]
              reason: Completed
              startedAt: '2023-04-13T14:24:46Z'
          - container: step-upload-sbom
            imageID: >-
              quay.io/redhat-appstudio/cosign@sha256:18b3716a6225727877475e1ab4f2493915e72cffd2ce431e9901d2ed2e4b2c0b
            name: upload-sbom
            terminated:
              containerID: >-
                cri-o://32310e4709851386e052e4a439199a2a41a55a50437d8ba1af65489e15de721d
              exitCode: 0
              finishedAt: '2023-04-13T14:24:55Z'
              message: >-
                [{"key":"BASE_IMAGES_DIGESTS","value":"registry.access.redhat.com/ubi9/go-toolset:1.18@sha256:2a518c02504b95202eaccfc5f987854c641ffa215dc379b5205e88260b15970e\nregistry.access.redhat.com/ubi9-minimal:9.1.0@sha256:95413c8dacaac773421428947a431c1cb099d19b4b1125df77d5d1cd2f463ab8\n","type":1},{"key":"IMAGE_DIGEST","value":"sha256:f489d25fd3500e58d7eca8f7434a4f9d6e1e9a4c29c10cf36538b23bac987fc9","type":1},{"key":"IMAGE_URL","value":"quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143","type":1},{"key":"JAVA_COMMUNITY_DEPENDENCIES","value":"","type":1}]
              reason: Completed
              startedAt: '2023-04-13T14:24:54Z'
        taskResults:
          - name: JAVA_COMMUNITY_DEPENDENCIES
            type: string
            value: ''
          - name: BASE_IMAGES_DIGESTS
            type: string
            value: >
              registry.access.redhat.com/ubi9/go-toolset:1.18@sha256:2a518c02504b95202eaccfc5f987854c641ffa215dc379b5205e88260b15970e

              registry.access.redhat.com/ubi9-minimal:9.1.0@sha256:95413c8dacaac773421428947a431c1cb099d19b4b1125df77d5d1cd2f463ab8
          - name: IMAGE_DIGEST
            type: string
            value: >-
              sha256:f489d25fd3500e58d7eca8f7434a4f9d6e1e9a4c29c10cf36538b23bac987fc9
          - name: IMAGE_URL
            type: string
            value: >-
              quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
        taskSpec:
          description: >-
            Buildah task builds source code into a container image and pushes
            the image into container registry using buildah tool.

            In addition it generates a SBOM file, injects the SBOM file into
            final container image and pushes the SBOM file as separate image
            using cosign tool.

            When [Java dependency
            rebuild](https://redhat-appstudio.github.io/docs.stonesoup.io/Documentation/main/cli/proc_enabled_java_dependencies.html)
            is enabled it triggers rebuilds of Java artifacts.

            When prefetch-dependencies task was activated it is using its
            artifacts to run build in hermetic environment.
          params:
            - description: Reference of the image buildah will produce.
              name: IMAGE
              type: string
            - default: >-
                registry.access.redhat.com/ubi9/buildah:9.0.0-19@sha256:c8b1d312815452964885680fc5bc8d99b3bfe9b6961228c71a09c72ca8e915eb
              description: The location of the buildah builder image.
              name: BUILDER_IMAGE
              type: string
            - default: ./Dockerfile
              description: Path to the Dockerfile to build.
              name: DOCKERFILE
              type: string
            - default: .
              description: Path to the directory to use as context.
              name: CONTEXT
              type: string
            - default: 'true'
              description: >-
                Verify the TLS on the registry endpoint (for push/pull to a
                non-TLS registry)
              name: TLSVERIFY
              type: string
            - description: secret with config.json for container auth
              name: DOCKER_AUTH
              type: string
            - default: 'false'
              description: Determines if build will be executed without network access.
              name: HERMETIC
              type: string
            - default: ''
              description: >-
                In case it is not empty, the prefetched content should be made
                available to the build.
              name: PREFETCH_INPUT
              type: string
          results:
            - description: Digest of the image just built
              name: IMAGE_DIGEST
              type: string
            - description: Image repository where the built image was pushed
              name: IMAGE_URL
              type: string
            - description: Digests of the base images used for build
              name: BASE_IMAGES_DIGESTS
              type: string
            - description: The counting of Java components by publisher in JSON format
              name: SBOM_JAVA_COMPONENTS_COUNT
              type: string
            - description: >-
                The Java dependencies that came from community sources such as
                Maven central.
              name: JAVA_COMMUNITY_DEPENDENCIES
              type: string
          stepTemplate:
            env:
              - name: BUILDAH_FORMAT
                value: oci
              - name: STORAGE_DRIVER
                value: vfs
              - name: HERMETIC
                value: 'false'
              - name: PREFETCH_INPUT
              - name: DOCKER_CONFIG
                value: /secrets/registry-auth
              - name: CONTEXT
                value: .
              - name: DOCKERFILE
                value: images/migrator/Dockerfile
              - name: IMAGE
                value: >-
                  quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
              - name: TLSVERIFY
                value: 'true'
            name: ''
            resources: {}
          steps:
            - image: 'quay.io/redhat-appstudio/buildah:v1.28'
              name: build
              resources:
                limits:
                  cpu: '2'
                  memory: 4Gi
                requests:
                  cpu: 10m
                  memory: 512Mi
              script: >
                if [ -e "$CONTEXT/$DOCKERFILE" ]; then
                  dockerfile_path="$CONTEXT/$DOCKERFILE"
                elif [ -e "$DOCKERFILE" ]; then
                  dockerfile_path="$DOCKERFILE"
                elif echo "$DOCKERFILE" | grep -q "^https\?://"; then
                  echo "Fetch Dockerfile from $DOCKERFILE"
                  dockerfile_path=$(mktemp --suffix=-Dockerfile)
                  http_code=$(curl -s -L -w "%{http_code}" --output "$dockerfile_path" "$DOCKERFILE")
                  if [ $http_code != 200 ]; then
                    echo "No Dockerfile is fetched. Server responds $http_code"
                    exit 1
                  fi
                  http_code=$(curl -s -L -w "%{http_code}" --output "$dockerfile_path.dockerignore.tmp" "$DOCKERFILE.dockerignore")
                  if [ $http_code = 200 ]; then
                    echo "Fetched .dockerignore from $DOCKERFILE.dockerignore"
                    mv "$dockerfile_path.dockerignore.tmp" $CONTEXT/.dockerignore
                  fi
                else
                  echo "Cannot find Dockerfile $DOCKERFILE"
                  exit 1
                fi

                if [ -n "$JVM_BUILD_WORKSPACE_ARTIFACT_CACHE_PORT_80_TCP_ADDR" ]
                && grep -q '^\s*RUN \(./\)\?mvn' "$dockerfile_path"; then
                  sed -i -e "s|^\s*RUN \(\(./\)\?mvn\(.*\)\)|RUN echo \"<settings><mirrors><mirror><id>mirror.default</id><url>http://$JVM_BUILD_WORKSPACE_ARTIFACT_CACHE_PORT_80_TCP_ADDR/v1/cache/default/0/</url><mirrorOf>*</mirrorOf></mirror></mirrors></settings>\" > /tmp/settings.yaml; \1 -s /tmp/settings.yaml|g" "$dockerfile_path"
                  touch /var/lib/containers/java
                fi



                sed -i 's/^\s*short-name-mode\s*=\s*.*/short-name-mode =
                "disabled"/' /etc/containers/registries.conf


                # Setting new namespace to run buildah - 2^32-2

                echo 'root:1:4294967294' | tee -a /etc/subuid >> /etc/subgid


                if [ "${HERMETIC}" == "true" ]; then
                  BUILDAH_ARGS="--pull=never"
                  UNSHARE_ARGS="--net"
                  for image in $(grep -i '^\s*FROM' "$dockerfile_path" | sed 's/--platform=\S*//' | awk '{print $2}'); do
                    unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -- buildah pull $image
                  done
                  echo "Build will be executed with network isolation"
                fi


                if [ -n "${PREFETCH_INPUT}" ]; then
                  mv cachi2 /tmp/
                  chmod -R go+rwX /tmp/cachi2
                  VOLUME_MOUNTS="--volume /tmp/cachi2:/cachi2"
                  sed -i 's|^\s*run |RUN . /cachi2/cachi2.env \&\& \\\n    |i' "$dockerfile_path"
                  echo "Prefetched content will be made available"
                fi


                unshare -Uf $UNSHARE_ARGS --keep-caps -r --map-users 1,1,65536
                --map-groups 1,1,65536 -- buildah bud \
                  $VOLUME_MOUNTS \
                  $BUILDAH_ARGS \
                  --tls-verify=$TLSVERIFY --no-cache \
                  --ulimit nofile=4096:4096 \
                  -f "$dockerfile_path" -t $IMAGE $CONTEXT

                container=$(buildah from --pull-never $IMAGE)

                buildah mount $container | tee /workspace/container_path

                echo $container > /workspace/container_name
              securityContext:
                capabilities:
                  add:
                    - SETFCAP
              volumeMounts:
                - mountPath: /var/lib/containers
                  name: varlibcontainers
                - mountPath: /secrets/registry-auth
                  name: registry-auth
              workingDir: /workspace/source
            - image: 'quay.io/redhat-appstudio/syft:v0.47.0'
              name: sbom-get
              resources: {}
              script: >
                syft dir:/workspace/source
                --file=/workspace/source/sbom-source.json
                --output=cyclonedx-json

                find $(cat /workspace/container_path) -xtype l -delete

                syft dir:$(cat /workspace/container_path)
                --file=/workspace/source/sbom-image.json --output=cyclonedx-json
              volumeMounts:
                - mountPath: /var/lib/containers
                  name: varlibcontainers
            - image: >-
                quay.io/redhat-appstudio/hacbs-jvm-build-request-processor:1d417e6f1f3e68c6c537333b5759796eddae0afc
              name: analyse-dependencies-java-sbom
              resources: {}
              script: |
                if [ -f /var/lib/containers/java ]; then
                  /opt/jboss/container/java/run/run-java.sh analyse-dependencies path $(cat /workspace/container_path) -s /workspace/source/sbom-image.json --task-run-name tekton-results-migrator-on-push-xqhhw-build-container --publishers /tekton/results/SBOM_JAVA_COMPONENTS_COUNT
                  sed -i 's/^/ /' /tekton/results/SBOM_JAVA_COMPONENTS_COUNT # Workaround for SRVKP-2875
                else
                  touch /tekton/results/JAVA_COMMUNITY_DEPENDENCIES
                fi
              securityContext:
                runAsUser: 0
              volumeMounts:
                - mountPath: /var/lib/containers
                  name: varlibcontainers
            - image: 'registry.access.redhat.com/ubi9/python-39:1-108'
              name: merge-sboms
              resources: {}
              script: >
                #!/bin/python3

                import json

                import os


                # load SBOMs

                with open("./sbom-image.json") as f:
                  image_sbom = json.load(f)

                with open("./sbom-source.json") as f:
                  source_sbom = json.load(f)

                # fetch unique components from available SBOMs

                def get_identifier(component):
                  return component["name"] + '@' + component.get("version", "")

                existing_components = [get_identifier(component) for component
                in image_sbom["components"]]


                for component in source_sbom["components"]:
                  if get_identifier(component) not in existing_components:
                    image_sbom["components"].append(component)
                    existing_components.append(get_identifier(component))

                image_sbom["components"].sort(key=lambda c: get_identifier(c))


                # write the CycloneDX unified SBOM

                with open("./sbom-cyclonedx.json", "w") as f:
                  json.dump(image_sbom, f, indent=4)

                # create and write the PURL unified SBOM

                purls = [{"purl": component["purl"]} for component in
                image_sbom["components"] if "purl" in component]

                purl_content = {"image_contents": {"dependencies": purls}}


                with open("sbom-purl.json", "w") as output_file:
                  json.dump(purl_content, output_file, indent=4)
              securityContext:
                runAsUser: 0
              workingDir: /workspace/source
            - image: >-
                registry.access.redhat.com/ubi9/buildah:9.0.0-19@sha256:c8b1d312815452964885680fc5bc8d99b3bfe9b6961228c71a09c72ca8e915eb
              name: inject-sbom-and-push
              resources: {}
              script: >
                # Expose base image digests

                buildah images --format '{{ .Name }}:{{ .Tag }}@{{ .Digest }}' |
                grep -v $IMAGE > /tekton/results/BASE_IMAGES_DIGESTS


                base_image_name=$(buildah inspect --format '{{ index
                .ImageAnnotations "org.opencontainers.image.base.name"}}'
                $IMAGE)

                base_image_digest=$(buildah inspect --format '{{ index
                .ImageAnnotations "org.opencontainers.image.base.digest"}}'
                $IMAGE)

                container=$(buildah from --pull-never $IMAGE)

                buildah copy $container sbom-cyclonedx.json sbom-purl.json
                /root/buildinfo/content_manifests/

                buildah config -a
                org.opencontainers.image.base.name=${base_image_name} -a
                org.opencontainers.image.base.digest=${base_image_digest}
                $container

                buildah commit $container $IMAGE

                buildah push \
                  --tls-verify=$TLSVERIFY \
                  --digestfile /workspace/source/image-digest $IMAGE \
                  docker://$IMAGE
                cat "/workspace/source"/image-digest | tee
                /tekton/results/IMAGE_DIGEST

                echo -n "$IMAGE" | tee /tekton/results/IMAGE_URL
              securityContext:
                capabilities:
                  add:
                    - SETFCAP
                runAsUser: 0
              volumeMounts:
                - mountPath: /var/lib/containers
                  name: varlibcontainers
                - mountPath: /secrets/registry-auth
                  name: registry-auth
              workingDir: /workspace/source
            - args:
                - attach
                - sbom
                - '--sbom'
                - sbom-cyclonedx.json
                - '--type'
                - cyclonedx
                - >-
                  quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
              image: 'quay.io/redhat-appstudio/cosign:v1.13.1'
              name: upload-sbom
              resources: {}
              volumeMounts:
                - mountPath: /secrets/registry-auth
                  name: registry-auth
              workingDir: /workspace/source
          volumes:
            - emptyDir: {}
              name: varlibcontainers
            - name: registry-auth
              secret:
                optional: true
                secretName: tekton-results-migrator-on-push-xqhhw
          workspaces:
            - description: Workspace containing the source code to build.
              name: source
      whenExpressions:
        - input: 'true'
          operator: in
          values:
            - 'true'
    tekton-results-migrator-on-push-xqhhw-clone-repository:
      pipelineTaskName: clone-repository
      status:
        completionTime: '2023-04-13T14:22:24Z'
        conditions:
          - lastTransitionTime: '2023-04-13T14:22:24Z'
            message: All Steps have completed executing
            reason: Succeeded
            status: 'True'
            type: Succeeded
        podName: tekton-results-migrator-on-push-xqhhw-clone-repository-pod
        startTime: '2023-04-13T14:22:01Z'
        steps:
          - container: step-clone
            imageID: >-
              registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8@sha256:2fa0b06d52b04f377c696412e19307a9eff27383f81d87aae0b4f71672a1cd0b
            name: clone
            terminated:
              containerID: >-
                cri-o://08bf335f8e126e39ee4fb42f53b340206670a047b823ce72fdc4f91aedcc5d94
              exitCode: 0
              finishedAt: '2023-04-13T14:22:23Z'
              message: >-
                [{"key":"commit","value":"4c93d5c4f34d96d31ade787ee1856d144e342143","type":1},{"key":"url","value":"https://github.com/openshift-pipelines/tektoncd-results","type":1}]
              reason: Completed
              startedAt: '2023-04-13T14:22:20Z'
        taskResults:
          - name: commit
            type: string
            value: 4c93d5c4f34d96d31ade787ee1856d144e342143
          - name: url
            type: string
            value: 'https://github.com/openshift-pipelines/tektoncd-results'
        taskSpec:
          description: >-
            The git-clone Task will clone a repo from the provided url into the
            output Workspace. By default the repo will be cloned into the root
            of your Workspace.
          params:
            - description: Repository URL to clone from.
              name: url
              type: string
            - default: ''
              description: 'Revision to checkout. (branch, tag, sha, ref, etc...)'
              name: revision
              type: string
            - default: ''
              description: Refspec to fetch before checking out revision.
              name: refspec
              type: string
            - default: 'true'
              description: Initialize and fetch git submodules.
              name: submodules
              type: string
            - default: '1'
              description: >-
                Perform a shallow clone, fetching only the most recent N
                commits.
              name: depth
              type: string
            - default: 'true'
              description: >-
                Set the `http.sslVerify` global git config. Setting this to
                `false` is not advised unless you are sure that you trust your
                git remote.
              name: sslVerify
              type: string
            - default: ''
              description: >-
                Subdirectory inside the `output` Workspace to clone the repo
                into.
              name: subdirectory
              type: string
            - default: ''
              description: >-
                Define the directory patterns to match or exclude when
                performing a sparse checkout.
              name: sparseCheckoutDirectories
              type: string
            - default: 'true'
              description: >-
                Clean out the contents of the destination directory if it
                already exists before cloning.
              name: deleteExisting
              type: string
            - default: ''
              description: HTTP proxy server for non-SSL requests.
              name: httpProxy
              type: string
            - default: ''
              description: HTTPS proxy server for SSL requests.
              name: httpsProxy
              type: string
            - default: ''
              description: Opt out of proxying HTTP/HTTPS requests.
              name: noProxy
              type: string
            - default: 'true'
              description: >-
                Log the commands that are executed during `git-clone`'s
                operation.
              name: verbose
              type: string
            - default: >-
                registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8:v1.8.2-8@sha256:a538c423e7a11aae6ae582a411fdb090936458075f99af4ce5add038bb6983e8
              description: The image providing the git-init binary that this Task runs.
              name: gitInitImage
              type: string
            - default: /tekton/home
              description: >
                Absolute path to the user's home directory. Set this explicitly
                if you are running the image as a non-root user or have
                overridden

                the gitInitImage param with an image containing custom user
                configuration.
              name: userHome
              type: string
          results:
            - description: The precise commit SHA that was fetched by this Task.
              name: commit
              type: string
            - description: The precise URL that was fetched by this Task.
              name: url
              type: string
          steps:
            - env:
                - name: HOME
                  value: /tekton/home
                - name: PARAM_URL
                  value: 'https://github.com/openshift-pipelines/tektoncd-results'
                - name: PARAM_REVISION
                  value: 4c93d5c4f34d96d31ade787ee1856d144e342143
                - name: PARAM_REFSPEC
                - name: PARAM_SUBMODULES
                  value: 'true'
                - name: PARAM_DEPTH
                  value: '1'
                - name: PARAM_SSL_VERIFY
                  value: 'true'
                - name: PARAM_SUBDIRECTORY
                - name: PARAM_DELETE_EXISTING
                  value: 'true'
                - name: PARAM_HTTP_PROXY
                - name: PARAM_HTTPS_PROXY
                - name: PARAM_NO_PROXY
                - name: PARAM_VERBOSE
                  value: 'true'
                - name: PARAM_SPARSE_CHECKOUT_DIRECTORIES
                - name: PARAM_USER_HOME
                  value: /tekton/home
                - name: WORKSPACE_OUTPUT_PATH
                  value: /workspace/output
                - name: WORKSPACE_SSH_DIRECTORY_BOUND
                  value: 'false'
                - name: WORKSPACE_SSH_DIRECTORY_PATH
                - name: WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND
                  value: 'false'
                - name: WORKSPACE_BASIC_AUTH_DIRECTORY_PATH
              image: >-
                registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8:v1.8.2-8@sha256:a538c423e7a11aae6ae582a411fdb090936458075f99af4ce5add038bb6983e8
              name: clone
              resources: {}
              script: >
                #!/usr/bin/env sh

                set -eu


                if [ "${PARAM_VERBOSE}" = "true" ] ; then
                  set -x
                fi


                if [ "${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}" = "true" ] ; then
                  cp "${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials" "${PARAM_USER_HOME}/.git-credentials"
                  cp "${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig" "${PARAM_USER_HOME}/.gitconfig"
                  chmod 400 "${PARAM_USER_HOME}/.git-credentials"
                  chmod 400 "${PARAM_USER_HOME}/.gitconfig"
                fi


                if [ "${WORKSPACE_SSH_DIRECTORY_BOUND}" = "true" ] ; then
                  cp -R "${WORKSPACE_SSH_DIRECTORY_PATH}" "${PARAM_USER_HOME}"/.ssh
                  chmod 700 "${PARAM_USER_HOME}"/.ssh
                  chmod -R 400 "${PARAM_USER_HOME}"/.ssh/*
                fi


                CHECKOUT_DIR="${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}"


                cleandir() {
                  # Delete any existing contents of the repo directory if it exists.
                  #
                  # We don't just "rm -rf ${CHECKOUT_DIR}" because ${CHECKOUT_DIR} might be "/"
                  # or the root of a mounted volume.
                  if [ -d "${CHECKOUT_DIR}" ] ; then
                    # Delete non-hidden files and directories
                    rm -rf "${CHECKOUT_DIR:?}"/*
                    # Delete files and directories starting with . but excluding ..
                    rm -rf "${CHECKOUT_DIR}"/.[!.]*
                    # Delete files and directories starting with .. plus any other character
                    rm -rf "${CHECKOUT_DIR}"/..?*
                  fi
                }


                if [ "${PARAM_DELETE_EXISTING}" = "true" ] ; then
                  cleandir
                fi


                test -z "${PARAM_HTTP_PROXY}" || export
                HTTP_PROXY="${PARAM_HTTP_PROXY}"

                test -z "${PARAM_HTTPS_PROXY}" || export
                HTTPS_PROXY="${PARAM_HTTPS_PROXY}"

                test -z "${PARAM_NO_PROXY}" || export
                NO_PROXY="${PARAM_NO_PROXY}"


                /ko-app/git-init \
                  -url="${PARAM_URL}" \
                  -revision="${PARAM_REVISION}" \
                  -refspec="${PARAM_REFSPEC}" \
                  -path="${CHECKOUT_DIR}" \
                  -sslVerify="${PARAM_SSL_VERIFY}" \
                  -submodules="${PARAM_SUBMODULES}" \
                  -depth="${PARAM_DEPTH}" \
                  -sparseCheckoutDirectories="${PARAM_SPARSE_CHECKOUT_DIRECTORIES}"
                cd "${CHECKOUT_DIR}"

                RESULT_SHA="$(git rev-parse HEAD)"

                EXIT_CODE="$?"

                if [ "${EXIT_CODE}" != 0 ] ; then
                  exit "${EXIT_CODE}"
                fi

                printf "%s" "${RESULT_SHA}" > "/tekton/results/commit"

                printf "%s" "${PARAM_URL}" > "/tekton/results/url"
              securityContext:
                runAsUser: 0
          workspaces:
            - description: >-
                The git repo will be cloned onto the volume backing this
                Workspace.
              name: output
            - description: >
                A .ssh directory with private key, known_hosts, config, etc.
                Copied to

                the user's home before git commands are executed. Used to
                authenticate

                with the git remote when performing the clone. Binding a Secret
                to this

                Workspace is strongly recommended over other volume types.
              name: ssh-directory
              optional: true
            - description: >
                A Workspace containing a .gitconfig and .git-credentials file.
                These

                will be copied to the user's home before any git commands are
                run. Any

                other files in this Workspace are ignored. It is strongly
                recommended

                to use ssh-directory over basic-auth whenever possible and to
                bind a

                Secret to this Workspace over other volume types.
              name: basic-auth
              optional: true
      whenExpressions:
        - input: 'true'
          operator: in
          values:
            - 'true'
    tekton-results-migrator-on-push-xqhhw-init:
      pipelineTaskName: init
      status:
        completionTime: '2023-04-13T14:21:51Z'
        conditions:
          - lastTransitionTime: '2023-04-13T14:21:51Z'
            message: All Steps have completed executing
            reason: Succeeded
            status: 'True'
            type: Succeeded
        podName: tekton-results-migrator-on-push-xqhhw-init-pod
        startTime: '2023-04-13T14:21:40Z'
        steps:
          - container: step-init
            imageID: >-
              registry.redhat.io/openshift4/ose-tools-rhel8@sha256:4d89da145a14501b049397dc723a2b5feba1f2238c9f71659c9512bd27ca4e95
            name: init
            terminated:
              containerID: >-
                cri-o://17753cc81d577ca3305be0fffce299a0f77fda86db2ebde6334ed64211122b19
              exitCode: 0
              finishedAt: '2023-04-13T14:21:50Z'
              message: >-
                [{"key":"build","value":"true","type":1},{"key":"container-registry-secret","value":"tekton-results-migrator-on-push-xqhhw","type":1}]
              reason: Completed
              startedAt: '2023-04-13T14:21:49Z'
        taskResults:
          - name: build
            type: string
            value: 'true'
          - name: container-registry-secret
            type: string
            value: tekton-results-migrator-on-push-xqhhw
        taskSpec:
          description: >-
            Initialize Pipeline Task, include flags for rebuild and auth.
            Generates image repository secret used by the PipelineRun.
          params:
            - description: Image URL for build by PipelineRun
              name: image-url
              type: string
            - default: 'false'
              description: Rebuild the image if exists
              name: rebuild
              type: string
            - default: 'false'
              description: skip checks against built image
              name: skip-checks
              type: string
            - description: >-
                Name of current pipelinerun, should be
                "$(context.pipelineRun.name)"
              name: pipelinerun-name
              type: string
            - description: >-
                UID of current pipelinerun, should be
                "$(context.pipelineRun.uid)"
              name: pipelinerun-uid
              type: string
            - default: redhat-appstudio-user-workload
              description: >-
                Shared resource secret for accessing user-workload image
                repository
              name: shared-secret
              type: string
          results:
            - description: Defines if the image in param image-url should be built
              name: build
              type: string
            - description: Name of secret with credentials
              name: container-registry-secret
              type: string
          steps:
            - env:
                - name: PIPELINERUN_NAME
                  value: tekton-results-migrator-on-push-xqhhw
                - name: PIPELINERUN_UID
                  value: ce59052d-9d64-426f-a8e5-908ee3dc5697
                - name: IMAGE_URL
                  value: >-
                    quay.io/redhat-appstudio/tekton-results-migrator:4c93d5c4f34d96d31ade787ee1856d144e342143
                - name: REBUILD
                  value: 'false'
                - name: SKIP_CHECKS
                  value: 'false'
              image: >-
                registry.redhat.io/openshift4/ose-tools-rhel8:v4.12@sha256:4d89da145a14501b049397dc723a2b5feba1f2238c9f71659c9512bd27ca4e95
              name: init
              resources: {}
              script: >
                #!/bin/bash

                echo "Build Initialize: $IMAGE_URL"

                echo

                echo "Create pipelinerun repository secret"

                SHARED=/secret/default-push-secret/.dockerconfigjson

                export DOCKER_CONFIG=/tmp/docker/

                mkdir -p $DOCKER_CONFIG

                if [ -f $SHARED ]; then
                  jq -M -s '.[0] * .[1]' $SHARED /root/.docker/config.json > $DOCKER_CONFIG/config.json
                else
                  cp /root/.docker/config.json $DOCKER_CONFIG/config.json
                fi

                oc create secret generic --from-file=$DOCKER_CONFIG/config.json
                $SHARED_PARAM $PIPELINERUN_NAME

                oc patch secret $PIPELINERUN_NAME -p "{\"metadata\":
                {\"ownerReferences\": [{\"apiVersion\": \"tekton.dev/v1beta1\",
                \"blockOwnerDeletion\": false, \"controller\": true, \"kind\":
                \"PipelineRun\", \"name\": \"$PIPELINERUN_NAME\", \"uid\":
                \"$PIPELINERUN_UID\" }]}}"

                echo -n $PIPELINERUN_NAME >
                /tekton/results/container-registry-secret


                echo "Determine if Image Already Exists"

                # Build the image when image does not exists or rebuild is set
                to true

                if ! oc image info $IMAGE_URL &>/dev/null || [ "$REBUILD" ==
                "true" ] || [ "$SKIP_CHECKS" == "false" ]; then
                  echo -n "true" > /tekton/results/build
                else
                  echo -n "false" > /tekton/results/build
                fi
              volumeMounts:
                - mountPath: /secret/default-push-secret
                  name: default-push-secret
          volumes:
            - csi:
                driver: csi.sharedresource.openshift.io
                readOnly: true
                volumeAttributes:
                  sharedSecret: redhat-appstudio-user-workload
              name: default-push-secret
    tekton-results-migrator-on-push-xqhhw-sast-snyk-check:
      pipelineTaskName: sast-snyk-check
      status:
        completionTime: '2023-04-13T14:22:47Z'
        conditions:
          - lastTransitionTime: '2023-04-13T14:22:47Z'
            message: All Steps have completed executing
            reason: Succeeded
            status: 'True'
            type: Succeeded
        podName: tekton-results-migrator-on-push-xqhhw-sast-snyk-check-pod
        startTime: '2023-04-13T14:22:32Z'
        steps:
          - container: step-sast-snyk-check
            imageID: >-
              quay.io/redhat-appstudio/hacbs-test@sha256:853d6196d89e99da75abe5454ed969abc304f0647b113fa81a40fea2a3026d31
            name: sast-snyk-check
            terminated:
              containerID: >-
                cri-o://61a0b6012a4e22e3713b834cd221bbc2d6a7e01229ade4e387883177d4e97ee4
              exitCode: 0
              finishedAt: '2023-04-13T14:22:46Z'
              reason: Completed
              startedAt: '2023-04-13T14:22:46Z'
        taskSpec:
          description: >-
            Scans source code for security vulnerabilities, including common
            issues such as SQL injection, cross-site scripting (XSS), and code
            injection attacks using Snyk Code, a Static Application Security
            Testing (SAST) tool.
          params:
            - default: ''
              description: Name of secret which contains Snyk token.
              name: SNYK_SECRET
              type: string
            - default: '--all-projects --exclude=test*,vendor,deps'
              description: Append arguments.
              name: ARGS
              type: string
          results:
            - description: Tekton task test output.
              name: HACBS_TEST_OUTPUT
              type: string
          steps:
            - env:
                - name: SNYK_SECRET
                  value: snyk-shared-secret
                - name: ARGS
                  value: '--all-projects --exclude=test*,vendor,deps'
              image: >-
                quay.io/redhat-appstudio/hacbs-test:v1.0.12@sha256:8c833349cad40d34262548295cd4eb1bd330e42fbb221ef54e6caee15ae1d208
              name: sast-snyk-check
              resources: {}
              script: >
                #!/usr/bin/env bash

                . /utils.sh

                SNYK_TOKEN="$(cat /etc/secrets/snyk_token)"

                if [[ -z $SNYK_TOKEN ]]; then
                  echo "SNYK_TOKEN not defined. Create $SNYK_SECRET secret with key containing Snyk token." | tee stdout.txt
                  note="Task sast-snyk-check skipped: SNYK_TOKEN is empty."
                  HACBS_TEST_OUTPUT=$(make_result_json -r SKIPPED -t "$note")
                  exit 0
                fi

                export SNYK_TOKEN

                SNYK_EXIT_CODE=0

                snyk code test $ARGS ../..
                --sarif-file-output=sast_snyk_check_out.json 1>&2>> stdout.txt
                || SNYK_EXIT_CODE=$?

                test_not_skipped=0

                SKIP_MSG="We found 0 supported files"

                grep -q "$SKIP_MSG" stdout.txt || test_not_skipped=$?


                if [[ "$SNYK_EXIT_CODE" -eq 0 ]] || [[ "$SNYK_EXIT_CODE" -eq 1
                ]]; then
                  cat sast_snyk_check_out.json
                  HACBS_TEST_OUTPUT=
                  parse_hacbs_test_output sast-snyk-check sarif sast_snyk_check_out.json  || true

                # When the test is skipped, the "SNYK_EXIT_CODE" is 3 and it can
                also be 3 in some other situation

                elif [[ "$test_not_skipped" -eq 0 ]]; then
                  note="Task sast-snyk-check skipped: Snyk code test found zero supported files."
                  HACBS_ERROR_OUTPUT=$(make_result_json -r SKIPPED -t "$note")
                else
                  echo "sast-snyk-check test failed because of the following issues:"
                  cat stdout.txt
                  note="Task sast-snyk-check failed: For details, check Tekton task log."
                  HACBS_ERROR_OUTPUT=$(make_result_json -r ERROR -t "$note")
                fi

                echo "${HACBS_TEST_OUTPUT:-${HACBS_ERROR_OUTPUT}}" | tee
                /tekton/results/HACBS_TEST_OUTPUT
              volumeMounts:
                - mountPath: /etc/secrets
                  name: snyk-secret
                  readOnly: true
              workingDir: /workspace/workspace/hacbs/sast-snyk-check
          volumes:
            - name: snyk-secret
              secret:
                optional: true
                secretName: snyk-shared-secret
          workspaces:
            - name: workspace
      whenExpressions:
        - input: 'false'
          operator: in
          values:
            - 'false'
        - input: snyk-shared-secret
          operator: notin
          values:
            - ''
