From 41c8d4bb89c870648eb85b06b9b04eb2f131521d Mon Sep 17 00:00:00 2001 From: Brandon Squizzato Date: Tue, 27 Oct 2026 14:22:16 -0400 Subject: [PATCH 1/2] fix(konflux): set prefetch-input so prefetch-dependencies attests package registry proxy The enterprise-contract rule prefetch_dependencies.package_registry_proxy_enabled fails for api-server, cli, control-plane, web-console and fleet-dashboard. These pipelines already wire enable-package-registry-proxy=true, but the plain prefetch-dependencies task skips its only step when prefetch-input is empty, so the parameter is never recorded in the SLSA attestation that the rule reads. The components already on trusted-artifacts (agent-runtime, fullsend-sandbox) pass because the oci-ta task records params even with empty input. Set a non-empty prefetch-input per ecosystem (gomod for the Go components, pnpm for the UI builds) so the prefetch step runs and the parameter is attested. No hermetic flag and no Dockerfile changes. Co-Authored-By: Claude Opus 4.8 --- .tekton/hypershell-api-server-main-merge-queue.yaml | 2 ++ .tekton/hypershell-api-server-main-pull-request.yaml | 2 ++ .tekton/hypershell-api-server-main-push.yaml | 2 ++ .tekton/hypershell-cli-main-merge-queue.yaml | 2 ++ .tekton/hypershell-cli-main-pull-request.yaml | 2 ++ .tekton/hypershell-cli-main-push.yaml | 2 ++ .tekton/hypershell-control-plane-main-merge-queue.yaml | 2 ++ .tekton/hypershell-control-plane-main-pull-request.yaml | 2 ++ .tekton/hypershell-control-plane-main-push.yaml | 2 ++ .tekton/hypershell-fleet-dashboard-main-merge-queue.yaml | 2 ++ .tekton/hypershell-fleet-dashboard-main-pull-request.yaml | 2 ++ .tekton/hypershell-fleet-dashboard-main-push.yaml | 2 ++ .tekton/hypershell-web-console-main-merge-queue.yaml | 2 ++ .tekton/hypershell-web-console-main-pull-request.yaml | 2 ++ .tekton/hypershell-web-console-main-push.yaml | 2 ++ 15 files changed, 30 insertions(+) diff --git a/.tekton/hypershell-api-server-main-merge-queue.yaml b/.tekton/hypershell-api-server-main-merge-queue.yaml index 3b44988eb..e3c7c0336 100644 --- a/.tekton/hypershell-api-server-main-merge-queue.yaml +++ b/.tekton/hypershell-api-server-main-merge-queue.yaml @@ -30,6 +30,8 @@ spec: value: Dockerfile - name: path-context value: components/api-server + - name: prefetch-input + value: '{"type": "gomod", "path": "components/api-server"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-api-server-main-pull-request.yaml b/.tekton/hypershell-api-server-main-pull-request.yaml index d8ed03629..54d086433 100644 --- a/.tekton/hypershell-api-server-main-pull-request.yaml +++ b/.tekton/hypershell-api-server-main-pull-request.yaml @@ -31,6 +31,8 @@ spec: value: Dockerfile - name: path-context value: components/api-server + - name: prefetch-input + value: '{"type": "gomod", "path": "components/api-server"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-api-server-main-push.yaml b/.tekton/hypershell-api-server-main-push.yaml index 352f6c4f0..2ff461166 100644 --- a/.tekton/hypershell-api-server-main-push.yaml +++ b/.tekton/hypershell-api-server-main-push.yaml @@ -37,6 +37,8 @@ spec: value: Dockerfile - name: path-context value: components/api-server + - name: prefetch-input + value: '{"type": "gomod", "path": "components/api-server"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-cli-main-merge-queue.yaml b/.tekton/hypershell-cli-main-merge-queue.yaml index e22f2249b..4b0da8de4 100644 --- a/.tekton/hypershell-cli-main-merge-queue.yaml +++ b/.tekton/hypershell-cli-main-merge-queue.yaml @@ -29,6 +29,8 @@ spec: value: Dockerfile - name: path-context value: components/cli + - name: prefetch-input + value: '{"type": "gomod", "path": "components/cli"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-cli-main-pull-request.yaml b/.tekton/hypershell-cli-main-pull-request.yaml index 49ace1ff4..4934b6258 100644 --- a/.tekton/hypershell-cli-main-pull-request.yaml +++ b/.tekton/hypershell-cli-main-pull-request.yaml @@ -31,6 +31,8 @@ spec: value: Dockerfile - name: path-context value: components/cli + - name: prefetch-input + value: '{"type": "gomod", "path": "components/cli"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-cli-main-push.yaml b/.tekton/hypershell-cli-main-push.yaml index b2c3a831d..2dcf8897d 100644 --- a/.tekton/hypershell-cli-main-push.yaml +++ b/.tekton/hypershell-cli-main-push.yaml @@ -28,6 +28,8 @@ spec: value: Dockerfile - name: path-context value: components/cli + - name: prefetch-input + value: '{"type": "gomod", "path": "components/cli"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-control-plane-main-merge-queue.yaml b/.tekton/hypershell-control-plane-main-merge-queue.yaml index fed7b68d9..efe52c097 100644 --- a/.tekton/hypershell-control-plane-main-merge-queue.yaml +++ b/.tekton/hypershell-control-plane-main-merge-queue.yaml @@ -31,6 +31,8 @@ spec: value: components/control-plane/Dockerfile - name: path-context value: . + - name: prefetch-input + value: '{"type": "gomod", "path": "components/control-plane"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-control-plane-main-pull-request.yaml b/.tekton/hypershell-control-plane-main-pull-request.yaml index f612193d1..517923ca2 100644 --- a/.tekton/hypershell-control-plane-main-pull-request.yaml +++ b/.tekton/hypershell-control-plane-main-pull-request.yaml @@ -31,6 +31,8 @@ spec: value: components/control-plane/Dockerfile - name: path-context value: . + - name: prefetch-input + value: '{"type": "gomod", "path": "components/control-plane"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-control-plane-main-push.yaml b/.tekton/hypershell-control-plane-main-push.yaml index 752a188e3..3ed4fc4ca 100644 --- a/.tekton/hypershell-control-plane-main-push.yaml +++ b/.tekton/hypershell-control-plane-main-push.yaml @@ -28,6 +28,8 @@ spec: value: components/control-plane/Dockerfile - name: path-context value: . + - name: prefetch-input + value: '{"type": "gomod", "path": "components/control-plane"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-fleet-dashboard-main-merge-queue.yaml b/.tekton/hypershell-fleet-dashboard-main-merge-queue.yaml index 00c7c7671..04bc50ebb 100644 --- a/.tekton/hypershell-fleet-dashboard-main-merge-queue.yaml +++ b/.tekton/hypershell-fleet-dashboard-main-merge-queue.yaml @@ -31,6 +31,8 @@ spec: value: components/fleet-dashboard/Dockerfile - name: path-context value: . + - name: prefetch-input + value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-fleet-dashboard-main-pull-request.yaml b/.tekton/hypershell-fleet-dashboard-main-pull-request.yaml index 579f7a94f..a554f4fec 100644 --- a/.tekton/hypershell-fleet-dashboard-main-pull-request.yaml +++ b/.tekton/hypershell-fleet-dashboard-main-pull-request.yaml @@ -31,6 +31,8 @@ spec: value: components/fleet-dashboard/Dockerfile - name: path-context value: . + - name: prefetch-input + value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-fleet-dashboard-main-push.yaml b/.tekton/hypershell-fleet-dashboard-main-push.yaml index 8ab43f39b..6031931e6 100644 --- a/.tekton/hypershell-fleet-dashboard-main-push.yaml +++ b/.tekton/hypershell-fleet-dashboard-main-push.yaml @@ -28,6 +28,8 @@ spec: value: components/fleet-dashboard/Dockerfile - name: path-context value: . + - name: prefetch-input + value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-web-console-main-merge-queue.yaml b/.tekton/hypershell-web-console-main-merge-queue.yaml index e3fa1dc75..9cc50f392 100644 --- a/.tekton/hypershell-web-console-main-merge-queue.yaml +++ b/.tekton/hypershell-web-console-main-merge-queue.yaml @@ -31,6 +31,8 @@ spec: value: components/web-console/Dockerfile - name: path-context value: . + - name: prefetch-input + value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-web-console-main-pull-request.yaml b/.tekton/hypershell-web-console-main-pull-request.yaml index fd74642ad..440ace36f 100644 --- a/.tekton/hypershell-web-console-main-pull-request.yaml +++ b/.tekton/hypershell-web-console-main-pull-request.yaml @@ -31,6 +31,8 @@ spec: value: components/web-console/Dockerfile - name: path-context value: . + - name: prefetch-input + value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-web-console-main-push.yaml b/.tekton/hypershell-web-console-main-push.yaml index 0c8e130f3..ed0e78018 100644 --- a/.tekton/hypershell-web-console-main-push.yaml +++ b/.tekton/hypershell-web-console-main-push.yaml @@ -28,6 +28,8 @@ spec: value: components/web-console/Dockerfile - name: path-context value: . + - name: prefetch-input + value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. From fad70f8c4911e715cf792bda0fe277e063cc7dde Mon Sep 17 00:00:00 2001 From: Brandon Squizzato Date: Tue, 27 Oct 2026 14:32:10 -0400 Subject: [PATCH 2/2] fix(konflux): limit prefetch-input to api-server, revert the rest Setting prefetch-input activates cachi2 build integration, which broke the cli, control-plane, web-console and fleet-dashboard builds (pnpm resolution 404s and gomod cache issues) even with hermetic disabled. Only api-server builds cleanly with gomod prefetch. Revert prefetch-input on the four that broke, restoring their working builds. They need the trusted-artifacts (oci-ta) pipeline instead, which clears the enterprise-contract rule with empty input and no cachi2 integration. Co-Authored-By: Claude Opus 4.8 --- .tekton/hypershell-cli-main-merge-queue.yaml | 2 -- .tekton/hypershell-cli-main-pull-request.yaml | 2 -- .tekton/hypershell-cli-main-push.yaml | 2 -- .tekton/hypershell-control-plane-main-merge-queue.yaml | 2 -- .tekton/hypershell-control-plane-main-pull-request.yaml | 2 -- .tekton/hypershell-control-plane-main-push.yaml | 2 -- .tekton/hypershell-fleet-dashboard-main-merge-queue.yaml | 2 -- .tekton/hypershell-fleet-dashboard-main-pull-request.yaml | 2 -- .tekton/hypershell-fleet-dashboard-main-push.yaml | 2 -- .tekton/hypershell-web-console-main-merge-queue.yaml | 2 -- .tekton/hypershell-web-console-main-pull-request.yaml | 2 -- .tekton/hypershell-web-console-main-push.yaml | 2 -- 12 files changed, 24 deletions(-) diff --git a/.tekton/hypershell-cli-main-merge-queue.yaml b/.tekton/hypershell-cli-main-merge-queue.yaml index 4b0da8de4..e22f2249b 100644 --- a/.tekton/hypershell-cli-main-merge-queue.yaml +++ b/.tekton/hypershell-cli-main-merge-queue.yaml @@ -29,8 +29,6 @@ spec: value: Dockerfile - name: path-context value: components/cli - - name: prefetch-input - value: '{"type": "gomod", "path": "components/cli"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-cli-main-pull-request.yaml b/.tekton/hypershell-cli-main-pull-request.yaml index 4934b6258..49ace1ff4 100644 --- a/.tekton/hypershell-cli-main-pull-request.yaml +++ b/.tekton/hypershell-cli-main-pull-request.yaml @@ -31,8 +31,6 @@ spec: value: Dockerfile - name: path-context value: components/cli - - name: prefetch-input - value: '{"type": "gomod", "path": "components/cli"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-cli-main-push.yaml b/.tekton/hypershell-cli-main-push.yaml index 2dcf8897d..b2c3a831d 100644 --- a/.tekton/hypershell-cli-main-push.yaml +++ b/.tekton/hypershell-cli-main-push.yaml @@ -28,8 +28,6 @@ spec: value: Dockerfile - name: path-context value: components/cli - - name: prefetch-input - value: '{"type": "gomod", "path": "components/cli"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-control-plane-main-merge-queue.yaml b/.tekton/hypershell-control-plane-main-merge-queue.yaml index efe52c097..fed7b68d9 100644 --- a/.tekton/hypershell-control-plane-main-merge-queue.yaml +++ b/.tekton/hypershell-control-plane-main-merge-queue.yaml @@ -31,8 +31,6 @@ spec: value: components/control-plane/Dockerfile - name: path-context value: . - - name: prefetch-input - value: '{"type": "gomod", "path": "components/control-plane"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-control-plane-main-pull-request.yaml b/.tekton/hypershell-control-plane-main-pull-request.yaml index 517923ca2..f612193d1 100644 --- a/.tekton/hypershell-control-plane-main-pull-request.yaml +++ b/.tekton/hypershell-control-plane-main-pull-request.yaml @@ -31,8 +31,6 @@ spec: value: components/control-plane/Dockerfile - name: path-context value: . - - name: prefetch-input - value: '{"type": "gomod", "path": "components/control-plane"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-control-plane-main-push.yaml b/.tekton/hypershell-control-plane-main-push.yaml index 3ed4fc4ca..752a188e3 100644 --- a/.tekton/hypershell-control-plane-main-push.yaml +++ b/.tekton/hypershell-control-plane-main-push.yaml @@ -28,8 +28,6 @@ spec: value: components/control-plane/Dockerfile - name: path-context value: . - - name: prefetch-input - value: '{"type": "gomod", "path": "components/control-plane"}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-fleet-dashboard-main-merge-queue.yaml b/.tekton/hypershell-fleet-dashboard-main-merge-queue.yaml index 04bc50ebb..00c7c7671 100644 --- a/.tekton/hypershell-fleet-dashboard-main-merge-queue.yaml +++ b/.tekton/hypershell-fleet-dashboard-main-merge-queue.yaml @@ -31,8 +31,6 @@ spec: value: components/fleet-dashboard/Dockerfile - name: path-context value: . - - name: prefetch-input - value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-fleet-dashboard-main-pull-request.yaml b/.tekton/hypershell-fleet-dashboard-main-pull-request.yaml index a554f4fec..579f7a94f 100644 --- a/.tekton/hypershell-fleet-dashboard-main-pull-request.yaml +++ b/.tekton/hypershell-fleet-dashboard-main-pull-request.yaml @@ -31,8 +31,6 @@ spec: value: components/fleet-dashboard/Dockerfile - name: path-context value: . - - name: prefetch-input - value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-fleet-dashboard-main-push.yaml b/.tekton/hypershell-fleet-dashboard-main-push.yaml index 6031931e6..8ab43f39b 100644 --- a/.tekton/hypershell-fleet-dashboard-main-push.yaml +++ b/.tekton/hypershell-fleet-dashboard-main-push.yaml @@ -28,8 +28,6 @@ spec: value: components/fleet-dashboard/Dockerfile - name: path-context value: . - - name: prefetch-input - value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-web-console-main-merge-queue.yaml b/.tekton/hypershell-web-console-main-merge-queue.yaml index 9cc50f392..e3fa1dc75 100644 --- a/.tekton/hypershell-web-console-main-merge-queue.yaml +++ b/.tekton/hypershell-web-console-main-merge-queue.yaml @@ -31,8 +31,6 @@ spec: value: components/web-console/Dockerfile - name: path-context value: . - - name: prefetch-input - value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-web-console-main-pull-request.yaml b/.tekton/hypershell-web-console-main-pull-request.yaml index 440ace36f..fd74642ad 100644 --- a/.tekton/hypershell-web-console-main-pull-request.yaml +++ b/.tekton/hypershell-web-console-main-pull-request.yaml @@ -31,8 +31,6 @@ spec: value: components/web-console/Dockerfile - name: path-context value: . - - name: prefetch-input - value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic. diff --git a/.tekton/hypershell-web-console-main-push.yaml b/.tekton/hypershell-web-console-main-push.yaml index ed0e78018..0c8e130f3 100644 --- a/.tekton/hypershell-web-console-main-push.yaml +++ b/.tekton/hypershell-web-console-main-push.yaml @@ -28,8 +28,6 @@ spec: value: components/web-console/Dockerfile - name: path-context value: . - - name: prefetch-input - value: '{"type": "pnpm", "path": "."}' pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while reducing network traffic.