apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  annotations:
    pipelinesascode.tekton.dev/state: started
    pipelinesascode.tekton.dev/source-branch: refs/heads/fbc-release-94fa1e8b
    pipeline.tekton.dev/release: d9974e2cce817a43c69789161f0824e05a7572af
    pipelinesascode.tekton.dev/repo-url: 'https://github.com/scoheb/e2e-base'
    pipelinesascode.tekton.dev/sha-title: e2e test
    results.tekton.dev/recordSummaryAnnotations: '{"repo":"e2e-base","commit":"7a21ba82aa5d473929eefaa22369d7fd416fe603","eventType":"push"}'
    pipelinesascode.tekton.dev/sender: scoheb
    tekton.dev/tags: konflux
    results.tekton.dev/record: dev-release-team-tenant/results/e971ea40-fd63-4499-a907-91e1e3c2ed88/records/1b53df8b-2b20-4a8f-9422-e520b8caa704
    pipelinesascode.tekton.dev/git-auth-secret: pac-gitauth-bgzhcn
    build.appstudio.openshift.io/repo: 'https://github.com/scoheb/e2e-base?rev=7a21ba82aa5d473929eefaa22369d7fd416fe603'
    pipelinesascode.tekton.dev/controller-info: '{"name":"default","configmap":"pipelines-as-code","secret":"pipelines-as-code-secret", "gRepo": "pipelines-as-code"}'
    tekton.dev/taskrunSpanContext: '{"traceparent":"00-9aaf4467e06320e0ada9b745c6df8f78-6fb362126f3116d7-01"}'
    chains.tekton.dev/signed: 'true'
    tekton.dev/pipelines.minVersion: 0.12.1
    pipelinesascode.tekton.dev/cancel-in-progress: 'false'
    pipelinesascode.tekton.dev/branch: fbc-release-94fa1e8b
    results.tekton.dev/result: dev-release-team-tenant/results/e971ea40-fd63-4499-a907-91e1e3c2ed88
    pipelinesascode.tekton.dev/log-url: 'https://konflux-ui.apps.stone-stg-rh01.l2vh.p1.openshiftapps.com/ns/dev-release-team-tenant/pipelinerun/fbc-release-94fa1e8b-on-push-4zfqc'
    build.appstudio.redhat.com/target_branch: fbc-release-94fa1e8b
    pipelinesascode.tekton.dev/url-org: scoheb
    pipelinesascode.tekton.dev/source-repo-url: 'https://github.com/scoheb/e2e-base'
    pipelinesascode.tekton.dev/max-keep-runs: '3'
    pipelinesascode.tekton.dev/original-prname: fbc-release-94fa1e8b-on-push
    pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "fbc-release-94fa1e8b"
    results.tekton.dev/childReadyForDeletion: 'true'
    pipelinesascode.tekton.dev/url-repository: e2e-base
    results.tekton.dev/stored: 'true'
    pipelinesascode.tekton.dev/repository: collector-c52fa0a2
    pipelinesascode.tekton.dev/sha: 7a21ba82aa5d473929eefaa22369d7fd416fe603
    pipelinesascode.tekton.dev/sha-url: 'https://github.com/scoheb/e2e-base/commit/7a21ba82aa5d473929eefaa22369d7fd416fe603'
    pipelinesascode.tekton.dev/git-provider: github
    pipelinesascode.tekton.dev/event-type: push
    build.appstudio.redhat.com/commit_sha: 7a21ba82aa5d473929eefaa22369d7fd416fe603
  resourceVersion: '1973076964'
  name: fbc-release-94fa1e8b-on-push-4zfqc-fbc-fips-check-oci-ta
  uid: 1b53df8b-2b20-4a8f-9422-e520b8caa704
  creationTimestamp: '2025-06-08T20:19:56Z'
  generation: 1
  managedFields:
    - apiVersion: tekton.dev/v1
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:annotations':
            'f:results.tekton.dev/result': {}
            'f:pipelinesascode.tekton.dev/controller-info': {}
            'f:chains.tekton.dev/signed': {}
            'f:pipelinesascode.tekton.dev/url-repository': {}
            'f:pipelinesascode.tekton.dev/repository': {}
            'f:pipelinesascode.tekton.dev/url-org': {}
            'f:build.appstudio.redhat.com/target_branch': {}
            'f:pipelinesascode.tekton.dev/git-provider': {}
            'f:pipelinesascode.tekton.dev/source-repo-url': {}
            'f:pipelinesascode.tekton.dev/log-url': {}
            'f:pipelinesascode.tekton.dev/max-keep-runs': {}
            'f:pipelinesascode.tekton.dev/event-type': {}
            'f:build.appstudio.redhat.com/commit_sha': {}
            'f:pipelinesascode.tekton.dev/original-prname': {}
            'f:pipelinesascode.tekton.dev/on-cel-expression': {}
            .: {}
            'f:pipelinesascode.tekton.dev/sha': {}
            'f:pipeline.tekton.dev/release': {}
            'f:pipelinesascode.tekton.dev/repo-url': {}
            'f:pipelinesascode.tekton.dev/sha-url': {}
            'f:pipelinesascode.tekton.dev/sender': {}
            'f:results.tekton.dev/recordSummaryAnnotations': {}
            'f:pipelinesascode.tekton.dev/state': {}
            'f:tekton.dev/tags': {}
            'f:pipelinesascode.tekton.dev/source-branch': {}
            'f:pipelinesascode.tekton.dev/sha-title': {}
            'f:build.appstudio.openshift.io/repo': {}
            'f:tekton.dev/taskrunSpanContext': {}
            'f:pipelinesascode.tekton.dev/git-auth-secret': {}
            'f:tekton.dev/pipelines.minVersion': {}
            'f:pipelinesascode.tekton.dev/branch': {}
            'f:pipelinesascode.tekton.dev/cancel-in-progress': {}
          'f:finalizers':
            .: {}
            'v:"chains.tekton.dev"': {}
          'f:labels':
            'f:tekton.dev/task': {}
            'f:tekton.dev/pipelineTask': {}
            'f:tekton.dev/pipelineRunUID': {}
            'f:pipelinesascode.tekton.dev/url-repository': {}
            'f:pipelines.appstudio.openshift.io/type': {}
            'f:pipelinesascode.tekton.dev/repository': {}
            'f:app.kubernetes.io/managed-by': {}
            'f:appstudio.openshift.io/application': {}
            'f:pipelinesascode.tekton.dev/url-org': {}
            'f:pipelinesascode.tekton.dev/event-type': {}
            'f:pipelinesascode.tekton.dev/original-prname': {}
            'f:tekton.dev/memberOf': {}
            .: {}
            'f:tekton.dev/pipelineRun': {}
            'f:pipelinesascode.tekton.dev/sha': {}
            'f:pipelinesascode.tekton.dev/state': {}
            'f:appstudio.openshift.io/component': {}
            'f:app.kubernetes.io/version': {}
            'f:tekton.dev/pipeline': {}
            'f:pipelinesascode.tekton.dev/cancel-in-progress': {}
          'f:ownerReferences':
            .: {}
            'k:{"uid":"e971ea40-fd63-4499-a907-91e1e3c2ed88"}': {}
        'f:spec':
          .: {}
          'f:params': {}
          'f:podTemplate':
            .: {}
            'f:nodeSelector':
              .: {}
              'f:konflux-ci.dev/workload': {}
            'f:tolerations': {}
          'f:serviceAccountName': {}
          'f:taskRef':
            .: {}
            'f:params': {}
            'f:resolver': {}
      manager: controller
      operation: Update
      time: '2025-06-08T20:19:56Z'
    - apiVersion: tekton.dev/v1
      fieldsType: FieldsV1
      fieldsV1:
        'f:status':
          .: {}
          'f:completionTime': {}
          'f:conditions': {}
          'f:podName': {}
          'f:provenance':
            .: {}
            'f:featureFlags':
              'f:verificationNoMatchPolicy': {}
              'f:runningInEnvWithInjectedSidecars': {}
              .: {}
              'f:maxResultSize': {}
              'f:awaitSidecarReadiness': {}
              'f:enableProvenanceInStatus': {}
              'f:enableParamEnum': {}
              'f:coschedule': {}
              'f:resultExtractionMethod': {}
              'f:enableAPIFields': {}
              'f:enforceNonfalsifiability': {}
            'f:refSource':
              .: {}
              'f:digest':
                .: {}
                'f:sha256': {}
              'f:entryPoint': {}
              'f:uri': {}
          'f:spanContext':
            .: {}
            'f:traceparent': {}
          'f:startTime': {}
          'f:taskSpec':
            .: {}
            'f:description': {}
            'f:params': {}
            'f:results': {}
            'f:stepTemplate':
              .: {}
              'f:computeResources': {}
              'f:volumeMounts': {}
            'f:steps': {}
            'f:volumes': {}
      manager: controller
      operation: Update
      subresource: status
      time: '2025-06-08T20:19:56Z'
    - apiVersion: tekton.dev/v1
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:annotations':
            'f:results.tekton.dev/childReadyForDeletion': {}
            'f:results.tekton.dev/record': {}
            'f:results.tekton.dev/stored': {}
          'f:finalizers':
            'v:"results.tekton.dev/taskrun"': {}
      manager: watcher
      operation: Update
      time: '2025-06-08T20:19:57Z'
  namespace: dev-release-team-tenant
  ownerReferences:
    - apiVersion: tekton.dev/v1
      blockOwnerDeletion: true
      controller: true
      kind: PipelineRun
      name: fbc-release-94fa1e8b-on-push-4zfqc
      uid: e971ea40-fd63-4499-a907-91e1e3c2ed88
  finalizers:
    - chains.tekton.dev
    - results.tekton.dev/taskrun
  labels:
    pipelinesascode.tekton.dev/state: started
    tekton.dev/memberOf: tasks
    appstudio.openshift.io/component: fbc-release-94fa1e8b
    app.kubernetes.io/version: v0.35.0
    tekton.dev/pipeline: fbc-release-94fa1e8b-on-push-4zfqc
    app.kubernetes.io/managed-by: pipelinesascode.tekton.dev
    pipelinesascode.tekton.dev/cancel-in-progress: 'false'
    appstudio.openshift.io/application: e2eapp-94fa1e8b
    tekton.dev/task: fbc-fips-check-oci-ta
    pipelinesascode.tekton.dev/url-org: scoheb
    tekton.dev/pipelineTask: fbc-fips-check-oci-ta
    tekton.dev/pipelineRunUID: e971ea40-fd63-4499-a907-91e1e3c2ed88
    pipelinesascode.tekton.dev/original-prname: fbc-release-94fa1e8b-on-push
    pipelines.appstudio.openshift.io/type: build
    pipelinesascode.tekton.dev/url-repository: e2e-base
    tekton.dev/pipelineRun: fbc-release-94fa1e8b-on-push-4zfqc
    pipelinesascode.tekton.dev/repository: collector-c52fa0a2
    pipelinesascode.tekton.dev/sha: 7a21ba82aa5d473929eefaa22369d7fd416fe603
    pipelinesascode.tekton.dev/event-type: push
spec:
  params:
    - name: image-digest
      value: 'sha256:83ee55eb133c7904fdd6537c4be79aad7921134cedb4551e5c6712489e8f2df4'
    - name: image-url
      value: 'quay.io/redhat-user-workloads-stage/dev-release-team-tenant/fbc-release-94fa1e8b:7a21ba82aa5d473929eefaa22369d7fd416fe603'
    - name: SOURCE_ARTIFACT
      value: 'oci:quay.io/redhat-user-workloads-stage/dev-release-team-tenant/fbc-release-94fa1e8b@sha256:0e2eb1461a5baccc140ec0a72289f4613598e3ce1b46d7e89341e0ccb25235e1'
  podTemplate:
    nodeSelector:
      konflux-ci.dev/workload: konflux-tenants
    tolerations:
      - effect: NoSchedule
        key: konflux-ci.dev/workload
        operator: Equal
        value: konflux-tenants
  serviceAccountName: build-pipeline-fbc-release-94fa1e8b
  taskRef:
    params:
      - name: name
        value: fbc-fips-check-oci-ta
      - name: bundle
        value: 'quay.io/konflux-ci/tekton-catalog/task-fbc-fips-check-oci-ta:0.1@sha256:479d93d8ff93e8e40025608fda6fc5049a556c88272e8391ddab39d95d04e307'
      - name: kind
        value: task
    resolver: bundles
  timeout: 2h0m0s
status:
  completionTime: '2025-06-08T20:19:56Z'
  conditions:
    - lastTransitionTime: '2025-06-08T20:19:56Z'
      message: |-
        error requesting remote resource: error getting "Git" "dev-release-team-tenant/git-fd2b595e97fbc353fab640d8ebdfb52d": error resolving repository: git clone error: Cloning into '/tmp/build-definitions-2289726970'...
        error: cannot fork() for remote-https: Resource temporarily unavailable: exit status 255
      reason: TaskRunResolutionFailed
      status: 'False'
      type: Succeeded
  podName: ''
  provenance:
    featureFlags:
      maxResultSize: 4096
      awaitSidecarReadiness: true
      coschedule: workspaces
      resultExtractionMethod: termination-message
      enableParamEnum: true
      enforceNonfalsifiability: none
      enableAPIFields: alpha
      runningInEnvWithInjectedSidecars: true
      verificationNoMatchPolicy: ignore
      enableProvenanceInStatus: true
    refSource:
      digest:
        sha256: 479d93d8ff93e8e40025608fda6fc5049a556c88272e8391ddab39d95d04e307
      entryPoint: fbc-fips-check-oci-ta
      uri: quay.io/konflux-ci/tekton-catalog/task-fbc-fips-check-oci-ta
  spanContext:
    traceparent: 00-9aaf4467e06320e0ada9b745c6df8f78-6fb362126f3116d7-01
  startTime: '2025-06-08T20:19:56Z'
  taskSpec:
    description: |-
      The fbc-fips-check task uses the check-payload tool to verify if an unreleased operator bundle in an FBC fragment image is FIPS compliant. It only scans operator bundle images which either claim to be FIPS compliant by setting the `features.operators.openshift.io/fips-compliant` label to `"true"` on the bundle image or require one of `OpenShift Kubernetes Engine, OpenShift Platform Plus or OpenShift Container Platform` subscriptions to run the operator on an Openshift cluster.
      This task extracts relatedImages from all unreleased operator bundle images from your FBC fragment and scans them. In the context of FBC fragment, an unreleased operator bundle image is the one that isn't currently present in the Red Hat production Index Image (`registry.redhat.io/redhat/redhat-operator-index`). It is necessary for relatedImages pullspecs to be pullable at build time of the FBC fragment.
      In order to resolve them, this task expects a ImageDigestMirrorSet file located at .tekton/images-mirror-set.yaml of your FBC fragment git repo. It should map unreleased registry.redhat.io pullspecs of relatedImages to their valid quay.io pullspecs. If the ImageDigestMirrorSet is not provided, the task will attempt to process the registry.redhat.io pullspecs as is and might fail.
    params:
      - description: The Trusted Artifact URI pointing to the artifact with the application source code.
        name: SOURCE_ARTIFACT
        type: string
      - description: Image digest to scan.
        name: image-digest
        type: string
      - description: Image URL.
        name: image-url
        type: string
    results:
      - description: Images processed in the task.
        name: IMAGES_PROCESSED
        type: string
      - description: Tekton task test output.
        name: TEST_OUTPUT
        type: string
    stepTemplate:
      computeResources: {}
      volumeMounts:
        - mountPath: /var/workdir
          name: workdir
    steps:
      - args:
          - use
          - $(params.SOURCE_ARTIFACT)=/var/workdir/source
        computeResources: {}
        image: 'quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:635a890e9f0211b4eb5b8c811d6f06b3ed9ff7da952ebad236fbfe52ba36dbf7'
        name: use-trusted-artifact
      - computeResources:
          limits:
            memory: 8Gi
          requests:
            cpu: '1'
            memory: 8Gi
        env:
          - name: IMAGE_URL
            value: $(params.image-url)
          - name: IMAGE_DIGEST
            value: $(params.image-digest)
          - name: SOURCE_CODE_DIR
            value: /var/workdir
        image: 'quay.io/redhat-appstudio/konflux-test:v1.4.27@sha256:5f3200bb9f52c888be99d3eeacde6445b21b731b9216e20259522eba99f9766e'
        name: get-unique-related-images
        script: |
          #!/usr/bin/env bash
          set -euo pipefail
          # shellcheck source=/dev/null
          . /utils.sh

          unique_related_images=()
          digests_processed=()
          images_processed_template='{"image": {"pullspec": "'"$IMAGE_URL"'", "digests": [%s]}}'

          image_mirror_map=""
          mirror_set="${SOURCE_CODE_DIR}/source/.tekton/images-mirror-set.yaml"
          if [[ -f "${mirror_set}" ]]; then
            mirror_set_yaml=$(cat "${mirror_set}")
            image_mirror_map=$(process_image_digest_mirror_set "${mirror_set_yaml}")
            echo "${image_mirror_map}" >"/tekton/home/related-images-map.txt"
          else
            echo "Could not find Image mirror set at ${mirror_set}. Unreleased bundles and relatedImages will fail the scan."
          fi

          image_without_tag=$(echo -n "${IMAGE_URL}" | sed "s/\(.*\):.*/\1/")
          # strip new-line escape symbol from parameter and save it to variable
          image_and_digest="${image_without_tag}@${IMAGE_DIGEST}"

          echo "Inspecting raw image manifest $image_and_digest."
          # Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes
          image_manifests=$(get_image_manifests -i "${image_and_digest}")
          echo "Image manifests are $image_manifests"

          echo "Getting Target ocp version for the FBC fragment"
          image_manifest_sha=$(echo "${image_manifests}" | jq -r 'to_entries[0].value')
          target_ocp_version=$(get_ocp_version_from_fbc_fragment "$image_without_tag@$image_manifest_sha")
          echo "${target_ocp_version#v}" >"/tekton/home/target_ocp_version.txt"
          echo "Target OCP version: ${target_ocp_version}"

          declare -A seen_related_images
          while read -r _ arch_sha; do
            digests_processed+=("\"$arch_sha\"")

            if ! unreleased_bundles=$(get_unreleased_bundle -i "$image_without_tag@$arch_sha"); then
              note="Task $(context.task.name) failed: Could not get unreleased bundle images from the fragment. Make sure you have ImagePullCredentials for registry.redhat.io"
              echo "${note}"
              TEST_OUTPUT=$(make_result_json -r FAILURE -f 1 -t "$note")
              echo "${TEST_OUTPUT}" | tee "$(results.TEST_OUTPUT.path)"
              exit 0
            fi

            if [ -z "${unreleased_bundles}" ]; then
              echo "No unreleased bundles found. Skipping check."
              exit 0
            fi

            for bundle in ${unreleased_bundles}; do
              echo "Processing bundle image : ${bundle}"

              image_accessible=0
              if ! bundle_out=$(opm render "$bundle"); then
                echo "Could not inspect original pullspec $bundle. Checking if there's a mirror present"
                if [ -n "${image_mirror_map}" ]; then
                  reg_and_repo=$(get_image_registry_and_repository "${bundle}")
                  echo "Mirror Map is $image_mirror_map"
                  mapfile -t mirrors < <(echo "${image_mirror_map}" | jq -r --arg image "${reg_and_repo}" '.[$image][]')
                  echo "Mirrors for $reg_and_repo are:"
                  printf "%s\n" "${mirrors[@]}"

                  for mirror in "${mirrors[@]}"; do
                    echo "Attempting to use mirror ${mirror}"
                    replaced_image=$(replace_image_pullspec "$bundle" "$mirror")
                    if ! bundle_out=$(opm render "$replaced_image"); then
                      echo "Mirror $mirror is inaccessible."
                      continue
                    fi
                    image_accessible=1
                    echo "Replacing $bundle with $replaced_image"
                    bundle="$replaced_image"
                    break
                  done

                fi
              else
                image_accessible=1
                echo "Successfully inspected $bundle. Mirror not required."
              fi

              # Run the FIPS check only if the bundle is part of the Openshift Subscription or has the fips label set
              if [[ $image_accessible -eq 0 ]]; then
                note="Task $(context.task.name) failed: Could not render unreleased bundle image: ${bundle}. Make sure the image is accessible or a mirror is provided for the same in images-mirror-set.yaml"
                echo "${note}"
                TEST_OUTPUT=$(make_result_json -r FAILURE -f 1 -t "$note")
                echo "${TEST_OUTPUT}" | tee "$(results.TEST_OUTPUT.path)"
                exit 0
              fi
              subscription_label=$(echo "${bundle_out}" | jq -r '.properties[] | select((.value | type == "object") and (.value.annotations["operators.openshift.io/valid-subscription"] != null)) | (.value.annotations["operators.openshift.io/valid-subscription"] | fromjson)[]')

              fips_annotation=$(echo "${bundle_out}" | jq -r '.properties[] | select((.value | type == "object") and (.value.annotations["features.operators.openshift.io/fips-compliant"]? == "true")) | .value.annotations["features.operators.openshift.io/fips-compliant"]')

              if ! echo "${subscription_label}" | grep -e "OpenShift Kubernetes Engine" -e "OpenShift Container Platform" -e "OpenShift Platform Plus"; then
                echo "OpenShift Kubernetes Engine, OpenShift Platform Plus or OpenShift Container Platform are not present in operators.openshift.io/valid-subscription."
                echo "Subscription labels are : $subscription_label"
                if [ -z "${fips_annotation}" ] || [ "${fips_annotation}" != "true" ]; then
                  echo "The annotation features.operators.openshift.io/fips-compliant is also not set to true. Skipping the FIPS static check for ${bundle}"
                  continue
                else
                  echo "The annotation features.operators.openshift.io/fips-compliant is set to true. Running the FIPS static check..."
                fi
              else
                echo "OpenShift Kubernetes Engine, OpenShift Platform Plus or OpenShift Container Platform are present in operators.openshift.io/valid-subscription. Running the FIPS static check..."
              fi

              manifest_related_images=$(extract_related_images_from_bundle "$bundle")
              if [ -n "$manifest_related_images" ]; then
                for img in $manifest_related_images; do
                  if [ -z "${seen_related_images["$img"]:-}" ]; then
                    unique_related_images+=("$img")
                    seen_related_images["$img"]=1
                  fi
                done
              fi
              echo "Current unique images list is ${unique_related_images[*]}"

            done
          done < <(echo "$image_manifests" | jq -r 'to_entries[] | "\(.key) \(.value)"')

          if [ ${#unique_related_images[@]} -gt 0 ]; then
            echo "Unique related images: ${unique_related_images[*]}"
            echo "${unique_related_images[*]}" >"/tekton/home/unique_related_images.txt"
          else
            echo "No related images found. Skipping check."
            exit 0
          fi

          # If the image is an Image Index, also add the Image Index digest to the list.
          if [[ "${digests_processed[*]}" != *"$IMAGE_DIGEST"* ]]; then
            digests_processed+=("\"$IMAGE_DIGEST\"")
          fi
          digests_processed_string=$(
            IFS=,
            echo "${digests_processed[*]}"
          )

          echo "${images_processed_template/\[%s]/[$digests_processed_string]}" >"/tekton/home/images_processed.txt"
        securityContext:
          capabilities:
            add:
              - SETFCAP
      - computeResources:
          limits:
            memory: 8Gi
          requests:
            cpu: 500m
            memory: 8Gi
        name: fips-operator-check-step-action
        ref:
          params:
            - name: url
              value: 'https://github.com/konflux-ci/build-definitions'
            - name: revision
              value: 59a81a7fa59a628693dc0a407d97e67acdf6d778
            - name: pathInRepo
              value: stepactions/fips-operator-check-step-action/0.1/fips-operator-check-step-action.yaml
          resolver: git
      - computeResources: {}
        env:
          - name: STEP_ACTION_TEST_OUTPUT
            value: $(steps.fips-operator-check-step-action.results.TEST_OUTPUT)
        image: 'quay.io/redhat-appstudio/konflux-test:v1.4.27@sha256:5f3200bb9f52c888be99d3eeacde6445b21b731b9216e20259522eba99f9766e'
        name: parse-images-processed-result
        script: |
          #!/usr/bin/env bash
          set -euo pipefail

          if [ -e "/tekton/home/images_processed.txt" ]; then
            tee "$(results.IMAGES_PROCESSED.path)" </tekton/home/images_processed.txt
            echo "${STEP_ACTION_TEST_OUTPUT}" | tee "$(results.TEST_OUTPUT.path)"
          else
            echo "Task was skipped. Exiting"
            exit 0
          fi
    volumes:
      - emptyDir: {}
        name: workdir
