openshift-pipelines
diff --git a/‎head‎
Lines changed: 1 addition & 1 deletion b/‎head‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎upstream/.github/workflows/codeql.yml‎
Lines changed: 4 additions & 4 deletions b/‎upstream/.github/workflows/codeql.yml‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎upstream/.github/workflows/go-coverage.yml‎
Lines changed: 65 additions & 0 deletions b/‎upstream/.github/workflows/go-coverage.yml‎
Lines changed: 65 additions & 0 deletions
diff --git a/‎upstream/.github/workflows/kind-e2e.yaml‎
Lines changed: 15 additions & 11 deletions b/‎upstream/.github/workflows/kind-e2e.yaml‎
Lines changed: 15 additions & 11 deletions
diff --git a/‎upstream/.github/workflows/lint.yaml‎
Lines changed: 2 additions & 2 deletions b/‎upstream/.github/workflows/lint.yaml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎upstream/.github/workflows/reusable-e2e.yaml‎
Lines changed: 12 additions & 18 deletions b/‎upstream/.github/workflows/reusable-e2e.yaml‎
Lines changed: 12 additions & 18 deletions
diff --git a/‎upstream/.github/workflows/test-on-crc.yaml‎
Lines changed: 0 additions & 76 deletions b/‎upstream/.github/workflows/test-on-crc.yaml‎
Lines changed: 0 additions & 76 deletions
diff --git a/‎upstream/.github/workflows/test-on-microshift.yaml‎
Lines changed: 69 additions & 0 deletions b/‎upstream/.github/workflows/test-on-microshift.yaml‎
Lines changed: 69 additions & 0 deletions
@@ -1 +1 @@
-ab93ad44dcfeb860b6648a91328acd218a71dfab
+0c9284f740d672930274efbe75033df55dc78515
@@ -40,11 +40,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@a8d1ac45b9a34d11fe398d5503176af0d06b303e # v3.30.7
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -58,7 +58,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@a8d1ac45b9a34d11fe398d5503176af0d06b303e # v3.30.7
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -71,6 +71,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@a8d1ac45b9a34d11fe398d5503176af0d06b303e # v3.30.7
       with:
         category: "/language:${{matrix.language}}"
@@ -0,0 +1,65 @@
+name: Go coverage
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches: ["main"]
+  push:
+    branches: ["main"]
+  # run at least once every 2 months to prevent the coverage artifact from expiring
+  schedule:
+    - cron: '14 3 1 */2 *'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  go-coverage:
+    name: Go coverage
+    runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          path: ${{ github.workspace }}/src/github.com/tektoncd/chains
+
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
+        with:
+          go-version-file: "${{ github.workspace }}/src/github.com/tektoncd/chains/go.mod"
+
+      - name: Generate coverage
+        working-directory: ${{ github.workspace }}/src/github.com/tektoncd/chains
+        run: |
+          go test -cover -coverprofile=coverage.txt ./... || true
+          echo "Generated coverage profile"
+
+      - name: Archive coverage results
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: code-coverage
+          path: ${{ github.workspace }}/src/github.com/tektoncd/chains/coverage.txt
+
+      - name: Comment on PR
+        if: github.event_name == 'pull_request'
+        uses: fgrosse/go-coverage-report@8c1d1a09864211d258937b1b1a5b849f7e4f2682 # v1.2.0
+        continue-on-error: true # This may fail if artifact on main branch does not exist (first run or expired)
+        with:
+          coverage-artifact-name: "code-coverage"
+          coverage-file-name: "coverage.txt"
@@ -6,6 +6,10 @@ on:
       - main
       - release-*
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 defaults:
   run:
     shell: bash
@@ -17,26 +21,26 @@ jobs:
       fail-fast: false # Keep running if one leg fails.
       matrix:
         # Keep in sync with the list of supported releases: https://kubernetes.io/releases/
-        # TODO: add 1.31.x once it is added in https://github.com/sigstore/scaffolding/releases
+        # Add latest k8s-version once it is added in https://github.com/sigstore/scaffolding/releases
         k8s-version:
-        - v1.28.x
-        - v1.29.x
-        - v1.30.x
+          - v1.31.x
+          - v1.32.x
+          - v1.33.x
     uses: ./.github/workflows/reusable-e2e.yaml
     with:
       k8s-version: ${{ matrix.k8s-version }}
-      pipelines-release: v0.50.1
+      pipelines-release: v1.2.0 # Latest version
   pipelines-lts:
     strategy:
       fail-fast: false # Keep running if one leg fails.
       matrix:
         pipelines-release:
-        # This should follow the list of versions from https://github.com/tektoncd/pipeline/blob/main/releases.md#release
-        - v0.53.5  # LTS
-        - v0.56.3  # LTS
-        - v0.59.2  # LTS
-        - v0.62.0
+          # This should follow the list of versions from https://github.com/tektoncd/pipeline/blob/main/releases.md#release
+          - v0.62.9  # LTS
+          - v0.65.7  # LTS
+          - v0.68.1  # LTS
+          - v1.0.0   # LTS
     uses: ./.github/workflows/reusable-e2e.yaml
     with:
-      k8s-version: v1.28.x
+      k8s-version: v1.30.x  # intersection of the latest version and scaffolding
       pipelines-release: ${{ matrix.pipelines-release }}
@@ -24,12 +24,12 @@ jobs:
     steps:
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: "1.22"
+          go-version: "1.23"
 
       - uses: actions/checkout@6d193bf28034eafb982f37bd894289fe649468fc # v4.1.7
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6.2.0
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
           # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
           version: latest
 
@@ -27,35 +27,29 @@ jobs:
       GOFLAGS: -ldflags=-s -ldflags=-w
       KO_DOCKER_REPO: registry.local:5000/knative
       KOCACHE: ~/ko
-      SIGSTORE_SCAFFOLDING_RELEASE_VERSION: "v0.7.12"
+      SIGSTORE_SCAFFOLDING_RELEASE_VERSION: "v0.7.24"
       TEKTON_PIPELINES_RELEASE: "https://storage.googleapis.com/tekton-releases/pipeline/previous/${{ inputs.pipelines-release }}/release.yaml"
       # Note that we do not include the v prefix here so we can use it in all
       # the places this is used.
-      TEKTON_CLI_RELEASE: "0.30.0"
+      SKIP_INITIALIZE: true
 
     steps:
     - name: Set up Go
       uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
       with:
         go-version: 1.22.x
 
-    - uses: ko-build/[email protected]
+    - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
       with:
         version: tip
 
-    - name: Install tkn cli
-      run: |
-        curl -Lo ./tkn_${{ env.TEKTON_CLI_RELEASE }}_Linux_x86_64.tar.gz https://github.com/tektoncd/cli/releases/download/v${{ env.TEKTON_CLI_RELEASE }}/tkn_${{ env.TEKTON_CLI_RELEASE }}_Linux_x86_64.tar.gz
-        tar xvzf ./tkn_${{ env.TEKTON_CLI_RELEASE }}_Linux_x86_64.tar.gz tkn
-        chmod u+x ./tkn
-
     - name: Check out our repo
       uses: actions/checkout@6d193bf28034eafb982f37bd894289fe649468fc # v4.1.7
       with:
         path: ./src/github.com/tektoncd/chains
 
     - name: Install mirror, kind, knative + sigstore
-      uses: sigstore/scaffolding/actions/setup@main
+      uses: sigstore/scaffolding/actions/setup@d40cf576f588d980142f0b8462c425d7b32f00b1 # v0.7.25
       with:
         k8s-version: ${{ inputs.k8s-version }}
         version: ${{ env.SIGSTORE_SCAFFOLDING_RELEASE_VERSION }}
@@ -72,12 +66,14 @@ jobs:
         # Restart so picks up the changes.
         kubectl -n tekton-pipelines delete po -l app=tekton-pipelines-controller
 
-    - name: Install all the everythings
+    - name: Run integration tests
       working-directory: ./src/github.com/tektoncd/chains
-      timeout-minutes: 10
       run: |
-        ko apply -BRf ./config/
+        ./test/presubmit-tests.sh --integration-tests
 
+
+    - name: Run tutorial taskrun
+      run: |
         kubectl patch configmap/chains-config \
         --namespace tekton-chains \
         --type merge \
@@ -88,10 +84,8 @@ jobs:
 
         # TODO(vaikas): Better way to find when the chains has picked up
         # the changes
-        sleep 10
+        sleep 20
 
-    - name: Run tutorial taskrun
-      run: |
         kubectl create -f https://raw.githubusercontent.com/tektoncd/chains/main/examples/taskruns/task-output-image.yaml
 
         # Sleep so the taskrun shows up.
@@ -103,7 +97,7 @@ jobs:
         echo "Waiting for Chains to do it's thing"
         for i in {1..10}
         do
-          ./tkn tr describe --last -o jsonpath="{.metadata.annotations.chains\.tekton\.dev/transparency}" > tektonentry
+          tkn tr describe --last -o jsonpath="{.metadata.annotations.chains\.tekton\.dev/transparency}" > tektonentry
 
           if [ -s ./tektonentry ]; then
             if grep --quiet rekor.rekor-system.svc ./tektonentry ; then
@@ -126,7 +120,7 @@ jobs:
 
     - name: Collect diagnostics
       if: ${{ failure() }}
-      uses: chainguard-dev/actions/kind-diag@9c0be1ee0103db886d1887d114ec97f8766b7ef8 # main
+      uses: chainguard-dev/actions/kind-diag@5363dd9eb48083bbf7674a4bbe62d71c3b230edd # v1.1.2
       with:
         cluster-resources: nodes
         namespace-resources: pods,taskruns,jobs
@@ -0,0 +1,69 @@
+name: Test Chains on Microshift
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - main
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  tekton-chains-e2e-tests-microshift:
+    name: Run E2E Tests on Microshift
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+
+    env:
+      SHELL: /bin/bash
+      GOPATH: ${{ github.workspace }}
+      KO_DOCKER_REPO: ko.local
+      DOCKER_HOST: tcp://localhost:24816
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        path: ${{ github.workspace }}/src/github.com/tektoncd/chains
+
+    - uses: imjasonh/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
+
+    - name: Set up Go
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      with:
+          cache-dependency-path: "${{ github.workspace }}/src/github.com/tektoncd/chains/go.sum"
+          go-version-file: "${{ github.workspace }}/src/github.com/tektoncd/chains/go.mod"
+
+    - name: setup microshift
+      run: |
+          curl -L -o minc  https://github.com/minc-org/minc/releases/latest/download/minc_linux_amd64
+          chmod +x minc
+          ./minc create --log-level debug
+
+    - name: Install Tekton Chains and Run e2e tests
+      working-directory: ${{ github.workspace }}/src/github.com/tektoncd/chains
+
+      run: |
+          echo -e "\n************************ Install openshift client ************************\n"
+          wget https://github.com/okd-project/okd/releases/download/4.19.0-okd-scos.6/openshift-client-linux-amd64-rhel9-4.19.0-okd-scos.6.tar.gz
+          tar -xzvf openshift-client-linux-amd64-rhel9-4.19.0-okd-scos.6.tar.gz
+          export PATH=${PATH}:${PWD}
+
+          echo -e "\n************************ Setup Podman ************************\n"
+          sudo podman system service --time=0 tcp://localhost:24816 &
+          sleep 7
+          echo -e "\ntest the podman tcp connection\n"
+          curl http://localhost:24816/_ping
+
+          echo -e "\n************************ Starting e2e ************************\n"
+          oc adm policy add-scc-to-user anyuid -z tekton-pipelines-controller
+          oc adm policy add-scc-to-user anyuid -z tekton-pipelines-webhook
+
+          export KUBECONFIG=$HOME/.kube/config
+
+          source ${{ github.workspace }}/src/github.com/tektoncd/chains/test/microshift_test.sh
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-ab93ad44dcfeb860b6648a91328acd218a71dfab`
	`1`	`+0c9284f740d672930274efbe75033df55dc78515`