feat(RELEASE-400): incorporate check-data-keys task in release pipelines

This commit adds the check-data-keys task into the release pipelines to ensure validation of required data keys. Signed-off-by: Sean Conroy <sconroy@redhat.com>
konflux-ci · Dec 4, 2024 · fd07115 · fd07115
1 parent 070946e
commit fd07115
Show file tree

Hide file tree

Showing 13 changed files with 202 additions and 18 deletions.
diff --git a/pipelines/fbc-release/README.md b/pipelines/fbc-release/README.md
@@ -19,6 +19,9 @@ Tekton release pipeline to interact with FBC Pipeline
 | taskGitUrl                      | The url to the git repo where the release-service-catalog tasks to be used are stored                    | Yes       | https://github.com/konflux-ci/release-service-catalog.git |
 | taskGitRevision                 | The revision in the taskGitUrl repo to be used                                                           | No        | -                                                               |
 
+## Changes in 4.1.0
+* Implement the `check-data-keys` task to validate the `data.json` file using the JSON schema.
+
 ## Changes in 4.0.2
 * Drop the `binaryImage` param from the task `add-fbc-contribution-to-index-image`, so IIB can auto resolve it.
 

diff --git a/pipelines/fbc-release/fbc-release.yaml b/pipelines/fbc-release/fbc-release.yaml
@@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: fbc-release
   labels:
-    app.kubernetes.io/version: "4.0.2"
+    app.kubernetes.io/version: "4.1.0"
   annotations:
     tekton.dev/pipelines.minVersion: "0.12.1"
     tekton.dev/tags: release
@@ -122,6 +122,30 @@ spec:
           workspace: release-workspace
       runAfter:
         - verify-access-to-resources
+    - name: check-data-keys
+      params:
+        - name: dataPath
+          value: "$(tasks.collect-data.results.data)"
+        - name: schema
+          value: $(params.taskGitUrl)/raw/$(params.taskGitRevision)/schema/dataKeys.json
+        - name: systems
+          value: 
+            - fbc
+            - sign
+      taskRef:
+        params:
+          - name: url
+            value: $(params.taskGitUrl)
+          - name: revision
+            value: $(params.taskGitRevision)
+          - name: pathInRepo
+            value: tasks/check-data-keys/check-data-keys.yaml
+        resolver: git
+      workspaces:
+        - name: data
+          workspace: release-workspace
+      runAfter:
+        - collect-data
     - name: validate-single-component
       taskRef:
         resolver: "git"

diff --git a/pipelines/push-disk-images-to-cdn/README.md b/pipelines/push-disk-images-to-cdn/README.md
@@ -20,6 +20,9 @@ Tekton Pipeline to push disk images to a cdn using pulp
 | taskGitUrl                      | The url to the git repo where the release-service-catalog tasks to be used are stored                  | Yes | https://github.com/konflux-ci/release-service-catalog.git |
 | taskGitRevision                 | The revision in the taskGitUrl repo to be used                                                         | No       | -               |
 
+## Changes in 1.2.1
+* add new parameter `schema` to the `check-data-keys` task.
+
 ## Changes in 1.2.0
 * The `push-disk-images` task now gets the `resultsDir` parameter from `collect-data` results
 * Add the task `update-cr-status` at the end of the pipeline to save all pipeline results

diff --git a/pipelines/push-disk-images-to-cdn/push-disk-images-to-cdn.yaml b/pipelines/push-disk-images-to-cdn/push-disk-images-to-cdn.yaml
@@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: push-disk-images-to-cdn
   labels:
-    app.kubernetes.io/version: "1.2.0"
+    app.kubernetes.io/version: "1.2.1"
   annotations:
     tekton.dev/pipelines.minVersion: "0.12.1"
     tekton.dev/tags: release
@@ -191,6 +191,8 @@ spec:
       params:
         - name: dataPath
           value: "$(tasks.collect-data.results.data)"
+        - name: schema
+          value:  $(params.taskGitUrl)/raw/$(params.taskGitRevision)/schema/dataKeys.json
         - name: systems
           value:
             - cdn

diff --git a/pipelines/release-to-github/README.md b/pipelines/release-to-github/README.md
@@ -19,6 +19,9 @@ Tekton release pipeline to release binaries extracted from the image built with
 | taskGitUrl                | The url to the git repo where the release-service-catalog tasks to be used are stored | Yes | https://github.com/konflux-ci/release-service-catalog.git |
 | taskGitRevision           | The revision in the taskGitUrl repo to be used                        | No        | -            |
 
+## Changes in 4.1.0
+* Implement the `check-data-keys` task to validate the `data.json` file using the JSON schema.
+
 ## Changes in 4.0.0
 * Drop the `enterpriseContractPublicKey` param. The verify task will take the value from the policy.
 

diff --git a/pipelines/release-to-github/release-to-github.yaml b/pipelines/release-to-github/release-to-github.yaml
@@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: release-to-github
   labels:
-    app.kubernetes.io/version: "4.0.0"
+    app.kubernetes.io/version: "4.1.0"
   annotations:
     tekton.dev/pipelines.minVersion: "0.12.1"
     tekton.dev/tags: release
@@ -110,6 +110,30 @@ spec:
           workspace: release-workspace
       runAfter:
         - verify-access-to-resources
+    - name: check-data-keys
+      params:
+        - name: dataPath
+          value: "$(tasks.collect-data.results.data)"
+        - name: schema
+          value: $(params.taskGitUrl)/raw/$(params.taskGitRevision)/schema/dataKeys.json
+        - name: systems
+          value: 
+            - github
+            - sign
+      taskRef:
+        params:
+          - name: url
+            value: $(params.taskGitUrl)
+          - name: revision
+            value: $(params.taskGitRevision)
+          - name: pathInRepo
+            value: tasks/check-data-keys/check-data-keys.yaml
+        resolver: git
+      workspaces:
+        - name: data
+          workspace: release-workspace
+      runAfter:
+        - collect-data
     - name: validate-single-component
       taskRef:
         resolver: "git"

diff --git a/pipelines/release-to-mrrc/README.md b/pipelines/release-to-mrrc/README.md
@@ -18,3 +18,6 @@ Tekton release pipeline to release maven artifacts extracted from the maven repo
 | verify_ec_task_bundle           | The location of the bundle containing the verify-enterprise-contract task                                                          | No       | -                                                         |
 | taskGitUrl                      | The url to the git repo where the release-service-catalog tasks to be used are stored                                              | Yes      | https://github.com/konflux-ci/release-service-catalog.git |
 | taskGitRevision                 | The revision in the taskGitUrl repo to be used                                                                                     | Yes      | production                                                |
+
+## Changes in 0.2.0
+* Implement the `check-data-keys` task to validate the `data.json` file using the JSON schema.
diff --git a/pipelines/release-to-mrrc/release-to-mrrc.yaml b/pipelines/release-to-mrrc/release-to-mrrc.yaml
@@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: release-to-mrrc
   labels:
-    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/version: "0.2.0"
   annotations:
     tekton.dev/pipelines.minVersion: "0.12.1"
     tekton.dev/tags: release
@@ -107,6 +107,29 @@ spec:
           workspace: release-workspace
       runAfter:
         - verify-access-to-resources
+    - name: check-data-keys
+      params:
+        - name: dataPath
+          value: "$(tasks.collect-data.results.data)"
+        - name: schema
+          value: $(params.taskGitUrl)/raw/$(params.taskGitRevision)/schema/dataKeys.json
+        - name: systems
+          value: 
+            - mrrc
+      taskRef:
+        params:
+          - name: url
+            value: $(params.taskGitUrl)
+          - name: revision
+            value: $(params.taskGitRevision)
+          - name: pathInRepo
+            value: tasks/check-data-keys/check-data-keys.yaml
+        resolver: git
+      workspaces:
+        - name: data
+          workspace: release-workspace
+      runAfter:
+        - collect-data
     - name: verify-enterprise-contract
       taskRef:
         resolver: "bundles"

diff --git a/pipelines/rh-advisories/README.md b/pipelines/rh-advisories/README.md
@@ -23,6 +23,9 @@ the rh-push-to-registry-redhat-io pipeline.
 | taskGitUrl                      | The url to the git repo where the release-service-catalog tasks to be used are stored                                              | Yes      | https://github.com/konflux-ci/release-service-catalog.git |
 | taskGitRevision                 | The revision in the taskGitUrl repo to be used                                                                                     | No       | -                                                         |
 
+## Changes in 1.5.7
+* add new parameter `schema` to the `check-data-keys` task.
+
 ## Changes in 1.5.6
 * new mandatory parameter resultsDirPath added to run-file-updates task
 

diff --git a/pipelines/rh-advisories/rh-advisories.yaml b/pipelines/rh-advisories/rh-advisories.yaml
@@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: rh-advisories
   labels:
-    app.kubernetes.io/version: "1.5.6"
+    app.kubernetes.io/version: "1.5.7"
   annotations:
     tekton.dev/pipelines.minVersion: "0.12.1"
     tekton.dev/tags: release
@@ -509,6 +509,8 @@ spec:
       params:
         - name: dataPath
           value: "$(tasks.collect-data.results.data)"
+        - name: schema
+          value:  $(params.taskGitUrl)/raw/$(params.taskGitRevision)/schema/dataKeys.json
         - name: systems
           value:
             - releaseNotes

diff --git a/schema/dataKeys.json b/schema/dataKeys.json
@@ -6,7 +6,7 @@
       "type": "array",
       "items": {
         "type": "string",
-        "enum": ["releaseNotes", "cdn"],
+        "enum": ["releaseNotes", "cdn", "fbc", "sign", "mrrc", "github"],
         "description": "List of systems that are supported to be required in the data"
       }
     },
@@ -520,9 +520,7 @@
         }
       },
       "then": {
-        "required": [
-          "releaseNotes"
-        ],
+        "required": ["releaseNotes"],
         "properties": {
           "releaseNotes": {
             "required": [
@@ -540,9 +538,7 @@
             ],
             "properties": {
               "content": {
-                "required": [
-                  "images"
-                ]
+                "required": ["images"]
               }
             }
           }
@@ -560,14 +556,107 @@
         }
       },
       "then": {
-        "required": [
-          "cdn"
-        ],
+        "required": ["cdn"],
         "properties": {
           "cdn": {
+            "required": ["env"]
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "systems": {
+            "contains": {
+              "const": "fbc"
+            }
+          }
+        }
+      },
+      "then": {
+        "required": ["fbc"],
+        "properties": {
+          "fbc": {
             "required": [
-              "env"
+              "allowedPackages",
+              "fromIndex",
+              "targetIndex",
+              "publishingCredentials",
+              "buildTimeoutSeconds",
+              "issueId",
+              "preGA",
+              "productName",
+              "productVersion"
             ]
+          },
+          "properties": {
+            "allowedPackages": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "systems": {
+            "contains": {
+              "const": "sign"
+            }
+          }
+        }
+      },
+      "then": {
+        "required": ["sign"],
+        "properties": {
+          "sign": {
+            "required": ["configMapName"]
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "systems": {
+            "contains": {
+              "const": "mrrc"
+            }
+          }
+        }
+      },
+      "then": {
+        "required": ["mrrc"],
+        "properties": {
+          "mrrc": {
+            "required": ["environment", "release", "awsSecret", "charonConfig"]
+          },
+          "releaseNotes": {
+            "required": ["product_name", "product_version"]
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "systems": {
+            "contains": {
+              "const": "github"
+            }
+          }
+        }
+      },
+      "then": {
+        "required": ["github"],
+        "properties": {
+          "github": {
+            "required": ["githubSecret"]
           }
         }
       }

diff --git a/tasks/check-data-keys/README.md b/tasks/check-data-keys/README.md
@@ -13,7 +13,11 @@ Currently, `releaseNotes`, and `cdn` are the only supported systems.
 |----------|---------------------------------------------------------|----------|---------------|
 | dataPath | Path to the JSON string of the merged data to use       | No       |               |
 | systems  | The systems to check that all data keys are present for | Yes      | []            |
-| schema   | The URl to the schema                                   | Yes      | https://github.com/konflux-ci/release-service-catalog/blob/production/schema/dataKeys.json |
+| schema   | The URl to the schema                                   | Yes      | https://github.com/konflux-ci/release-service-catalog/blob/development/schema/dataKeys.json |
+
+## Changes in 1.1.0
+* Add `-L` option to curl command to follow redirects for schema download.
+* Fixes README.md `schema` parameter description.
 
 ## Changes in 1.0.0
 * Replacing the check with a schema validator

diff --git a/tasks/check-data-keys/check-data-keys.yaml b/tasks/check-data-keys/check-data-keys.yaml
@@ -40,10 +40,11 @@ spec:
             exit 1
         fi
 
-        if ! curl -s --fail-with-body "$(params.schema)" -o /tmp/schema ; then
+        if ! curl -sL --fail-with-body "$(params.schema)" -o /tmp/schema ; then
             echo "Failed to download schema file: $(params.schema)"
             exit 1
         fi
+        cat "$(workspaces.data.path)/$(params.dataPath)"
 
         systemsJSON=$(echo "$@" | jq -R 'split(" ")')