Update POLICY_BUNDLE_DIGEST in tekton-task bundle and catalog

.github/workflows/konflux-policy.yaml

@@ -5,7 +5,11 @@ on:
   workflow_dispatch:
     inputs:
       run_tag:
-        description: 'Tag tested images'
+        description: 'Tag tested images as :konflux'
+        type: boolean
+        default: true
+      run_tekton_task_bundle:
+        description: 'Rebuild tekton-task bundle with updated policy digest'
         type: boolean
         default: true
       run_tekton_catalog:
@@ -115,18 +119,20 @@ jobs:
       run: |
         set -euo pipefail
 
-        echo "$BUNDLE_DIGESTS" | jq -r 'to_entries[] | "\(.key)|\(.value)"' | while IFS='|' read -r url pinned; do
+        echo "$BUNDLE_DIGESTS" | jq -r '
+          to_entries[] | select(.key | test("tekton-task") | not) |
+          "\(.key)|\(.value)"' | while IFS='|' read -r url pinned; do
           repo="${url%:*}"
           echo "Tagging ${pinned} → ${repo}:konflux"
           skopeo copy --all --digestfile image.digest \
             "docker://${pinned}" "docker://${repo}:konflux"
           echo "Image digest: $(cat image.digest)"
         done
 
-  tekton-catalog-release:
-    if: inputs.run_tekton_catalog != false
+  tekton-task-bundle:
+    if: ${{ !cancelled() && !failure() && inputs.run_tekton_task_bundle != false }}
     runs-on: ubuntu-latest
-    needs: [acceptance-tests]
+    needs: [acceptance-tests, tag]
 
     steps:
     - uses: actions/checkout@v4
@@ -137,10 +143,95 @@ jobs:
     - name: Install yq
       uses: mikefarah/yq@v4
 
-    - name: Extract tested tasks from pinned bundle digests
+    - name: Install tkn
+      uses: tektoncd/actions/setup-tektoncd-cli@v1
+      with:
+        version: latest
+
+    - name: Log in to quay.io/conforma
+      env:
+        CONFORMA_USER: ${{ secrets.BUNDLE_PUSH_USER_CONFORMA }}
+        CONFORMA_PASS: ${{ secrets.BUNDLE_PUSH_PASS_CONFORMA }}
+      run: crane auth login quay.io -u "$CONFORMA_USER" -p "$CONFORMA_PASS"
+
+    - name: Extract all tasks from tested bundle
       env:
         BUNDLE_DIGESTS: ${{ needs.acceptance-tests.outputs.bundle-digests }}
-      run: ./hack/extract-tested-tasks.sh /tmp/catalog-tasks
+      run: |
+        set -euo pipefail
+
+        BUNDLE=$(echo "$BUNDLE_DIGESTS" | jq -r '
+          to_entries[] | select(.key | test("tekton-task")) | .value')
+
+        if [ -z "$BUNDLE" ]; then
+          echo "ERROR: No tekton-task bundle found in BUNDLE_DIGESTS"
+          exit 1
+        fi
+
+        ./hack/extract-all-bundle-tasks.sh "$BUNDLE" /tmp/catalog-tasks
+
+    - name: Update policy bundle digest in task definitions
+      run: |
+        set -euo pipefail
+
+        NEW_DIGEST=$(crane digest quay.io/conforma/release-policy:konflux)
+        echo "Release policy digest: ${NEW_DIGEST}"
+
+        TASK_FILES=$(grep -rl 'POLICY_BUNDLE_DIGEST' /tmp/catalog-tasks/tasks/ || true)
+        if [ -z "$TASK_FILES" ]; then
+          echo "ERROR: No task files contain POLICY_BUNDLE_DIGEST"
+          exit 1
+        fi
+
+        for f in $TASK_FILES; do
+          OLD_DIGEST=$(yq eval '.spec.params[] | select(.name == "POLICY_BUNDLE_DIGEST") | .default' "$f")
+          if [ -z "$OLD_DIGEST" ] || [ "$OLD_DIGEST" = "null" ]; then
+            echo "Warning: could not extract current digest from $f, skipping"
+            continue
+          fi
+          if [ "$OLD_DIGEST" = "$NEW_DIGEST" ]; then
+            echo "Already up to date in $f"
+            continue
+          fi
+          yq eval '(.spec.params[] | select(.name == "POLICY_BUNDLE_DIGEST") | .default) = "'"${NEW_DIGEST}"'"' -i "$f"
+          echo "Updated $f: ${OLD_DIGEST} → ${NEW_DIGEST}"
+        done
+
+    - name: Push updated tekton-task bundle
+      run: |
+        set -euo pipefail
+
+        TASK_FILES=()
+        while IFS= read -r f; do
+          TASK_FILES+=("-f" "$f")
+        done < <(find /tmp/catalog-tasks/tasks -name '*.yaml' -type f)
+
+        tkn bundle push quay.io/conforma/tekton-task:konflux "${TASK_FILES[@]}"
+
+  tekton-catalog:
+    if: ${{ !cancelled() && !failure() && inputs.run_tekton_catalog != false }}
+    runs-on: ubuntu-latest
+    needs: [acceptance-tests, tekton-task-bundle]
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Install crane
+      uses: imjasonh/setup-crane@v0.4
+
+    - name: Install yq
+      uses: mikefarah/yq@v4
+
+    - name: Log in to quay.io/conforma
+      env:
+        CONFORMA_USER: ${{ secrets.BUNDLE_PUSH_USER_CONFORMA }}
+        CONFORMA_PASS: ${{ secrets.BUNDLE_PUSH_PASS_CONFORMA }}
+      run: crane auth login quay.io -u "$CONFORMA_USER" -p "$CONFORMA_PASS"
+
+    - name: Extract tasks from tekton-task:konflux bundle
+      run: |
+        set -euo pipefail
+        ./hack/extract-all-bundle-tasks.sh quay.io/conforma/tekton-task:konflux /tmp/catalog-tasks
 
     - name: Generate token
       id: app-token
@@ -165,12 +256,10 @@ jobs:
 
         cd tekton-catalog
 
-        # Copy extracted tasks into the catalog
         cp -r /tmp/catalog-tasks/tasks/* tasks/
 
         git add tasks/
 
-        # Check if there are staged changes
         if git diff --cached --quiet; then
           echo "No changes to task definitions"
           exit 0

hack/extract-all-bundle-tasks.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Copyright The Conforma Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Extracts all task definitions from a Tekton bundle and arranges them in
+# the catalog directory layout: tasks/<task-name>/<version>/<task-name>.yaml
+#
+# Unlike extract-tested-tasks.sh, this script extracts every task in the
+# bundle, not just those referenced in acceptance pipelines.
+#
+# Usage:
+#   extract-all-bundle-tasks.sh <bundle-ref> <output-dir>
+#
+# Arguments:
+#   bundle-ref  - OCI reference for the Tekton bundle (tag or digest)
+#   output-dir  - Directory to write extracted tasks into
+
+set -euo pipefail
+
+BUNDLE="${1:?Usage: extract-all-bundle-tasks.sh <bundle-ref> <output-dir>}"
+OUTPUT_DIR="${2:?Usage: extract-all-bundle-tasks.sh <bundle-ref> <output-dir>}"
+
+REPO="${BUNDLE%@*}"
+REPO="${REPO%:*}"
+
+MANIFEST=$(crane manifest "$BUNDLE")
+
+TASK_LAYERS=$(echo "$MANIFEST" | jq -c '
+    .layers[] | select(.annotations["dev.tekton.image.kind"] == "task")')
+
+if [ -z "$TASK_LAYERS" ]; then
+    echo "ERROR: No task layers found in bundle ${BUNDLE}"
+    exit 1
+fi
+
+COUNT=0
+while IFS= read -r layer; do
+    [ -z "$layer" ] && continue
+
+    DIGEST=$(echo "$layer" | jq -r '.digest')
+    NAME=$(echo "$layer" | jq -r '.annotations["dev.tekton.image.name"]')
+
+    echo "Extracting task: $NAME"
+
+    TASK_YAML=$(crane blob "${REPO}@${DIGEST}" | gunzip | tar -xO)
+
+    VERSION=$(echo "$TASK_YAML" | yq eval '.metadata.labels["app.kubernetes.io/version"]' -)
+    if [ -z "$VERSION" ] || [ "$VERSION" = "null" ]; then
+        echo "ERROR: Task $NAME is missing the app.kubernetes.io/version label"
+        exit 1
+    fi
+
+    TASK_DIR="${OUTPUT_DIR}/tasks/${NAME}/${VERSION}"
+    mkdir -p "$TASK_DIR"
+    echo "$TASK_YAML" | yq eval '.' -P - > "${TASK_DIR}/${NAME}.yaml"
+
+    echo "  Written to ${TASK_DIR}/${NAME}.yaml"
+    COUNT=$((COUNT + 1))
+done <<< "$TASK_LAYERS"
+
+echo ""
+echo "Done. Extracted ${COUNT} task(s) to ${OUTPUT_DIR}"