docs(spec): Konflux enterprise-contract conformance across all components

.dockerignore

@@ -3,6 +3,11 @@
 !package.json
 !pnpm-lock.yaml
 !pnpm-workspace.yaml
+# Hermeto injects a root .npmrc during hermetic Konflux builds (registry ->
+# prefetched file:// deps). It must survive into the build context for the pnpm
+# install stages to resolve offline; a benign committed .npmrc keeps local
+# (non-Hermeto) builds working.
+!.npmrc
 !images/
 images/**
 !images/brand/
@@ -34,6 +39,8 @@ packages/**
 !components/web-console/
 !components/web-console/**
 !scripts/bootstrap_pnpm.sh
+!prefetch/
+!prefetch/**
 **/node_modules
 **/.react-router
 **/build

.forbidden-terms-whitelist.json

@@ -1,4 +1,19 @@
 [
+  {
+    "filename": "components/control-plane/tools/helm/go.sum",
+    "line": 200,
+    "rationale": "Immutable upstream Go module checksum hash contains an incidental byte sequence; changing it would invalidate the go.sum."
+  },
+  {
+    "filename": "components/control-plane/tools/helm/go.sum",
+    "line": 457,
+    "rationale": "Immutable upstream Go module checksum hash contains an incidental byte sequence; changing it would invalidate the go.sum."
+  },
+  {
+    "filename": "components/agents/tools/gh/go.sum",
+    "line": 507,
+    "rationale": "Immutable upstream Go module checksum hash contains an incidental byte sequence; changing it would invalidate the go.sum."
+  },
   {
     "filename": "scripts/openapi-ir/go.sum",
     "line": 32,

.github/ci-impact-scopes.yml

@@ -377,6 +377,9 @@ scopes:
       - .github/ci-impact-scopes.yml
       - Makefile
       - .dockerignore
+      - .npmrc
+      - .gitmodules
+      - prefetch/**
       - .github/component-paths.json
       - .github/scripts/**
       - .github/actions/detect-konflux-components/**

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "components/agents/third_party/fullsend"]
+	path = components/agents/third_party/fullsend
+	url = https://github.com/fullsend-ai/fullsend.git

.npmrc

@@ -0,0 +1,5 @@
+# Intentionally minimal. During hermetic Konflux builds, Hermeto's inject-files
+# step appends a `registry=file://.../deps/pnpm/npm/` line here so pnpm resolves
+# dependencies from the prefetched cache offline (it preserves existing settings).
+# Locally this file carries no settings, so pnpm uses its defaults
+# (registry.npmjs.org). Do not add developer-specific settings here.

.tekton/hypershell-agent-runtime-main-merge-queue.yaml

@@ -29,6 +29,12 @@ spec:
     value: components/agents/Containerfile.agent-runtime
   - name: path-context
     value: .
+  - name: hermetic
+    value: "false"
+  - name: enable-package-registry-proxy
+    value: "true"
+  - name: prefetch-input
+    value: '[{"type": "gomod", "path": "components/cli"}, {"type": "gomod", "path": "components/agents/third_party/fullsend"}, {"type": "gomod", "path": "components/agents/tools/gh"}, {"type": "gomod", "path": "components/agents/tools/gitleaks"}]'
   pipelineSpec:
     description: |
       Build native Linux AMD64 and ARM64 agent images and publish their combined image index.

.tekton/hypershell-agent-runtime-main-pull-request.yaml

@@ -29,6 +29,12 @@ spec:
     value: components/agents/Containerfile.agent-runtime
   - name: path-context
     value: .
+  - name: hermetic
+    value: "false"
+  - name: enable-package-registry-proxy
+    value: "true"
+  - name: prefetch-input
+    value: '[{"type": "gomod", "path": "components/cli"}, {"type": "gomod", "path": "components/agents/third_party/fullsend"}, {"type": "gomod", "path": "components/agents/tools/gh"}, {"type": "gomod", "path": "components/agents/tools/gitleaks"}]'
   pipelineSpec:
     description: |
       Build native Linux AMD64 and ARM64 agent images and publish their combined image index.

.tekton/hypershell-agent-runtime-main-push.yaml

@@ -26,6 +26,12 @@ spec:
     value: components/agents/Containerfile.agent-runtime
   - name: path-context
     value: .
+  - name: hermetic
+    value: "false"
+  - name: enable-package-registry-proxy
+    value: "true"
+  - name: prefetch-input
+    value: '[{"type": "gomod", "path": "components/cli"}, {"type": "gomod", "path": "components/agents/third_party/fullsend"}, {"type": "gomod", "path": "components/agents/tools/gh"}, {"type": "gomod", "path": "components/agents/tools/gitleaks"}]'
   pipelineSpec:
     description: |
       Build native Linux AMD64 and ARM64 agent images and publish their combined image index.

.tekton/hypershell-agent-runtime-slim-main-merge-queue.yaml

@@ -29,6 +29,12 @@ spec:
     value: components/agents/Containerfile.agent-runtime-slim
   - name: path-context
     value: .
+  - name: hermetic
+    value: "false"
+  - name: enable-package-registry-proxy
+    value: "true"
+  - name: prefetch-input
+    value: '[{"type": "gomod", "path": "components/cli"}, {"type": "gomod", "path": "components/agents/third_party/fullsend"}, {"type": "gomod", "path": "components/agents/tools/gh"}, {"type": "gomod", "path": "components/agents/tools/gitleaks"}]'
   pipelineSpec:
     description: |
       Build native Linux AMD64 and ARM64 agent images and publish their combined image index.

.tekton/hypershell-agent-runtime-slim-main-pull-request.yaml

@@ -29,6 +29,12 @@ spec:
     value: components/agents/Containerfile.agent-runtime-slim
   - name: path-context
     value: .
+  - name: hermetic
+    value: "false"
+  - name: enable-package-registry-proxy
+    value: "true"
+  - name: prefetch-input
+    value: '[{"type": "gomod", "path": "components/cli"}, {"type": "gomod", "path": "components/agents/third_party/fullsend"}, {"type": "gomod", "path": "components/agents/tools/gh"}, {"type": "gomod", "path": "components/agents/tools/gitleaks"}]'
   pipelineSpec:
     description: |
       Build native Linux AMD64 and ARM64 agent images and publish their combined image index.

.tekton/hypershell-agent-runtime-slim-main-push.yaml

@@ -26,6 +26,12 @@ spec:
     value: components/agents/Containerfile.agent-runtime-slim
   - name: path-context
     value: .
+  - name: hermetic
+    value: "false"
+  - name: enable-package-registry-proxy
+    value: "true"
+  - name: prefetch-input
+    value: '[{"type": "gomod", "path": "components/cli"}, {"type": "gomod", "path": "components/agents/third_party/fullsend"}, {"type": "gomod", "path": "components/agents/tools/gh"}, {"type": "gomod", "path": "components/agents/tools/gitleaks"}]'
   pipelineSpec:
     description: |
       Build native Linux AMD64 and ARM64 agent images and publish their combined image index.