USHIFT-7406: feat: add crypto scan step to Microshift rebase periodic job for 5.0+

ci-operator/config/openshift/microshift/openshift-microshift-release-5.0.yaml

@@ -22,6 +22,20 @@ images:
           source_path: /go/src/github.com/openshift/microshift
     optional: true
     to: microshift-test-rpm
+  - dockerfile_literal: |
+      FROM src
+      USER 0
+      RUN dnf install -y podman shadow-utils jq file && dnf clean all && \
+          setcap cap_setuid+ep /usr/bin/newuidmap && \
+          setcap cap_setgid+ep /usr/bin/newgidmap && \
+          touch /etc/subgid /etc/subuid && \
+          chmod g=u /etc/subuid /etc/subgid
+      USER 1000
+    inputs:
+      src:
+        as:
+        - src
+    to: rebase-cryptoscan-src
 promotion:
   to:
   - disabled: true
@@ -87,12 +101,17 @@ tests:
   steps:
     workflow: openshift-ci-security
 - as: test-rebase
+  capabilities:
+  - intranet
+  - nested-podman
+  nested_podman: true
   optional: true
+  restrict_network_access: false
   run_if_changed: ^(assets/.*|scripts/auto-rebase/.*|go\.mod|vendor/.*|deps/.*)$
   steps:
     env:
       DRY_RUN: "y"
-    workflow: openshift-microshift-rebase
+    workflow: openshift-microshift-rebase-cryptoscan
 - as: e2e-aws-tests
   run_if_changed: ^(assets/.*|cmd/.*|etcd/.*|pkg/.*|packaging/.*|test/.*|vendor/.*|Makefile.*|scripts/.*)$
   steps:

ci-operator/config/openshift/microshift/openshift-microshift-release-5.0__periodics.yaml

@@ -8,6 +8,22 @@ build_root:
     name: release
     namespace: openshift
     tag: rhel-9-release-golang-1.26-openshift-5.0
+images:
+  items:
+  - dockerfile_literal: |
+      FROM src
+      USER 0
+      RUN dnf install -y podman shadow-utils jq file && dnf clean all && \
+          setcap cap_setuid+ep /usr/bin/newuidmap && \
+          setcap cap_setgid+ep /usr/bin/newgidmap && \
+          touch /etc/subgid /etc/subuid && \
+          chmod g=u /etc/subuid /etc/subgid
+      USER 1000
+    inputs:
+      src:
+        as:
+        - src
+    to: rebase-cryptoscan-src
 releases:
   latest:
     candidate:
@@ -34,16 +50,21 @@ resources:
       memory: 200Mi
 tests:
 - as: rebase-on-nightlies
+  capabilities:
+  - intranet
+  - nested-podman
   cron: 0 4 * * 1-5
+  nested_podman: true
   reporter_config:
     channel: '#microshift-alerts'
     job_states_to_report:
     - failure
     - error
     report_template: ':red_jenkins_circle: Job *{{.Spec.Job}}* ended with *{{.Status.State}}*.
       <{{.Status.URL}}|View logs>'
+  restrict_network_access: false
   steps:
-    workflow: openshift-microshift-rebase
+    workflow: openshift-microshift-rebase-cryptoscan
 - as: publish-release-notes
   cron: 0 5 * * 1-5
   reporter_config:

ci-operator/jobs/openshift/microshift/openshift-microshift-release-5.0-periodics.yaml

@@ -1918,6 +1918,8 @@ periodics:
     org: openshift
     repo: microshift
   labels:
+    capability/intranet: intranet
+    capability/nested-podman: nested-podman
     ci-operator.openshift.io/variant: periodics
     ci.openshift.io/generator: prowgen
     job-release: "5.0"

ci-operator/jobs/openshift/microshift/openshift-microshift-release-5.0-presubmits.yaml

@@ -2411,6 +2411,64 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )ocp-full-conformance-serial-rhel-eus,?($|\s.*)
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^release-5\.0$
+    - ^release-5\.0-
+    cluster: build01
+    context: ci/prow/periodics-images
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: periodics
+      ci.openshift.io/generator: prowgen
+      job-release: "5.0"
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-microshift-release-5.0-periodics-images
+    rerun_command: /test periodics-images
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --report-credentials-file=/etc/report/credentials
+        - --target=[images]
+        - --variant=periodics
+        command:
+        - ci-operator
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )periodics-images,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:
@@ -2504,6 +2562,8 @@ presubmits:
     decoration_config:
       skip_cloning: true
     labels:
+      capability/intranet: intranet
+      capability/nested-podman: nested-podman
       ci.openshift.io/generator: prowgen
       job-release: "5.0"
       pj-rehearse.openshift.io/can-be-rehearsed: "true"

ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/OWNERS

@@ -0,0 +1,5 @@
+approvers:
+- openshift-edge-approvers
+options: {}
+reviewers:
+- openshift-edge-reviewers

ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+set -xeuo pipefail
+
+if [[ "$JOB_NAME" == rehearse* ]]; then
+    echo "INFO: \$JOB_NAME starts with rehearse - running in DRY RUN mode"
+    export DRY_RUN=y
+fi
+
+export PATH="${HOME}/.local/bin:${PATH}"
+python3 -m ensurepip --upgrade
+pip3 install setuptools-rust cryptography pyyaml pygithub gitpython
+
+cp /secrets/import-secret/.dockerconfigjson ${HOME}/.pull-secret.json
+
+cd /go/src/github.com/openshift/microshift/
+DEST_DIR=${HOME}/.local/bin ./scripts/fetch_tools.sh yq
+./scripts/auto-rebase/rebase_job_entrypoint.sh

ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-ref.metadata.json

@@ -0,0 +1,11 @@
+{
+	"path": "openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-ref.yaml",
+	"owners": {
+		"approvers": [
+			"openshift-edge-approvers"
+		],
+		"reviewers": [
+			"openshift-edge-reviewers"
+		]
+	}
+}

ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-ref.yaml

@@ -0,0 +1,28 @@
+ref:
+  as: openshift-microshift-rebase-cryptoscan
+  from: rebase-cryptoscan-src
+  cli: latest
+  grace_period: 30m
+  commands: openshift-microshift-rebase-cryptoscan-commands.sh
+  env:
+  - name: DRY_RUN
+    default: ""
+  dependencies:
+  - name: "release:nightly-amd64"
+    env: "OPENSHIFT_RELEASE_IMAGE"
+  - name: "release:nightly-arm64"
+    env: "OPENSHIFT_RELEASE_IMAGE_ARM"
+  resources:
+    requests:
+      cpu: 800m
+      memory: 1800Mi
+  credentials:
+    - name: ci-pull-credentials
+      namespace: test-credentials
+      mount_path: /secrets/import-secret
+    - name: pr-creds
+      namespace: test-credentials
+      mount_path: /secrets/pr-creds
+  documentation: |-
+    This step rebases MicroShift and runs the Red Hat crypto scanner.
+    Uses a custom image with podman and jq to support crypto scanning.

ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-workflow.metadata.json

@@ -0,0 +1,11 @@
+{
+	"path": "openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-workflow.yaml",
+	"owners": {
+		"approvers": [
+			"openshift-edge-approvers"
+		],
+		"reviewers": [
+			"openshift-edge-reviewers"
+		]
+	}
+}

ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-workflow.yaml

@@ -0,0 +1,8 @@
+workflow:
+  as: openshift-microshift-rebase-cryptoscan
+  steps:
+    test:
+      - ref: openshift-microshift-rebase-cryptoscan
+  documentation: |-
+    This workflow rebases MicroShift and runs the Red Hat crypto scanner.
+    Uses a custom image with podman and jq to support crypto scanning.

ci-operator/step-registry/openshift/microshift/rebase/openshift-microshift-rebase-ref.yaml

@@ -7,6 +7,8 @@ ref:
   env:
   - name: DRY_RUN
     default: ""
+  - name: SKIP_CRYPTOSCAN
+    default: "true"
   dependencies:
   - name: "release:nightly-amd64"
     env: "OPENSHIFT_RELEASE_IMAGE"