feat(ISV-5128): add new Tekton task to update component sboms

[wcheang]

No description provided.

[openshift-ci]

Hi @wcheang. Thanks for your PR.

I'm waiting for a konflux-ci member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[mmalina]

"wip" is not a valid commit title prefix. This should probably be "feat". If you want to say that it's not ready for review yet, you can change the PR to Draft. (If a PR is created as Draft from the start, the reviewers won't be added until it's changed to Ready - maybe for next time.)

[wcheang]

@mmalina the CONTRIBUTING.md says Tekton task tests are not required, but the check is failing due to missing tests directory? All the logic is in the Python script and already covered by unit tests, but I can add some Tekton task tests too if it is required.

[mmalina]

@mmalina the CONTRIBUTING.md says Tekton task tests are not required, but the check is failing due to missing tests directory? All the logic is in the Python script and already covered by unit tests, but I can add some Tekton task tests too if it is required.

The doc is not correct. Fix here: #664

To explain, when we came up with the mechanism to write task tests, none of the tasks had tests, but there would be a tests directory and a sample run.yaml which was a taskrun definition using the task. So the reason for that sentence was that if you changed an existing task, you wouldn't be required to write tests for it.

I understand that in your case the task will not do much besides running the script, but it's still nice have some basic test to ensure there is no error in the task definition or something like that. I would recommend using a mock for the python script and just check that it was called with the parameters it was expected to be called with.

[wcheang]

The symlink appears to be set up with the wrong path in my previous change in the utils repos. PR to fix it here: konflux-ci/release-service-utils#295

[wcheang]

@mmalina Could you please help me figure out why the Tekton task tests are running into "permission denied" errors on all the scripts (tests/pre-apply-task-hook.sh and /home/sbom/update_component_sbom? I looked everything over on both repos, and couldn't tell what I was missing. The /home/sbom dir is added to the path, and there doesn't seem to be any other permission change needed for the utils scripts.

[mmalina]

@mmalina Could you please help me figure out why the Tekton task tests are running into "permission denied" errors on all the scripts (tests/pre-apply-task-hook.sh and /home/sbom/update_component_sbom? I looked everything over on both repos, and couldn't tell what I was missing. The /home/sbom dir is added to the path, and there doesn't seem to be any other permission change needed for the utils scripts.

The script doesn't have execute permissions:

$ ls -l sbom
total 72
lrwxr-xr-x@ 1 mmalina  staff    22  4 Oct 12:33 create_product_sbom -> create_product_sbom.py
-rwxr-xr-x@ 1 mmalina  staff  4862  8 Nov 13:12 create_product_sbom.py
-rw-r--r--@ 1 mmalina  staff  9927  8 Nov 13:12 test_create_product_sbom.py
-rw-r--r--@ 1 mmalina  staff  7457  4 Nov 09:15 test_update_component_sbom.py
lrwxr-xr-x@ 1 mmalina  staff    24  8 Nov 13:12 update_component_sbom -> update_component_sbom.py
-rw-r--r--@ 1 mmalina  staff  4466  4 Nov 09:15 update_component_sbom.py

That's something that's typically not shown in Github UI. It has the permissions it had when it was added. You can chmod 755 sbom/update_component_sbom.py and commit that change.

[johnbieren]

Two small nit picks left then I am good to approve

[johnbieren]

/ok-to-test

[johnbieren]

@wcheang can you squash this down to one commit and sign the commit?

[johnbieren]

/ok-to-test

[johnbieren]

@wcheang would you like this merged as soon as it passes e2e? I can turn on auto merge if so. If another PR is merged before this one passes though it will still have to be rebased

[wcheang]

@wcheang would you like this merged as soon as it passes e2e? I can turn on auto merge if so. If another PR is merged before this one passes though it will still have to be rebased

Yes please turn on auto-merge