build: enable hermetic builds for cli-stack

[sampras343]

Summary

• Enable hermetic builds for the model-transparency-cli-stack component (both push and pull-request pipelines)
• Prefetch input was already configured (gomod), but hermetic was set to false

Test plan

• Verify the cli-stack PR build passes with hermetic enabled

[qodo-for-securesign]

PR Summary by Qodo

Enable hermetic builds for model-transparency cli-stack Tekton pipelines

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Flip Tekton pipeline hermetic parameter to true for PR and push workflows.
• Ensure cli-stack builds run in a fully hermetic mode (no network-dependency drift).

Diagram

graph TD
  A["PR Pipeline (Tekton)"] --> B["hermetic=true"] --> D["Hermetic Build Execution"]
  C["Push Pipeline (Tekton)"] --> B --> D
  C --> E["gomod prefetch"]

Loading

High-Level Assessment

Setting the existing hermetic pipeline parameter to true is the most direct and maintainable approach, since the pipelines already support prefetching inputs (gomod) and the build logic is parameterized for hermetic execution.

Files changed (2) +2 / -2

Other (2) +2 / -2

model-transparency-cli-stack-main-pull-request.yamlEnable hermetic mode in PR pipeline +1/-1

Enable hermetic mode in PR pipeline

• Changes the 'hermetic' pipeline parameter from "false" to "true" for pull-request builds. This makes PR builds run with hermetic constraints to reduce environment-related build variance.

.tekton/model-transparency-cli-stack-main-pull-request.yaml

model-transparency-cli-stack-main-push.yamlEnable hermetic mode in push pipeline +1/-1

Enable hermetic mode in push pipeline

• Changes the 'hermetic' pipeline parameter from "false" to "true" for push builds. Keeps existing 'gomod' prefetch-input aligned with hermetic build requirements.

.tekton/model-transparency-cli-stack-main-push.yaml

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.90%. Comparing base (c7e1d24) to head (3005545).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #136   +/-   ##
=======================================
  Coverage   41.90%   41.90%           
=======================================
  Files          57       57           
  Lines        3625     3625           
=======================================
  Hits         1519     1519           
  Misses       1967     1967           
  Partials      139      139           

Flag	Coverage Δ
unit	41.90% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Hermetic missing prefetch-input ✓ Resolved 🐞 Bug ☼ Reliability

Description

The cli-stack pull-request PipelineRun now enables hermetic: "true" but does not set
prefetch-input, while the cli-stack push PipelineRun (and model-transparency-go hermetic
pipelines) include prefetch-input for Go module prefetching. If the referenced build pipeline
relies on prefetch-input to make hermetic/offline builds succeed, PR builds may become unreliable
or fail due to missing prefetched dependencies.

Code

.tekton/model-transparency-cli-stack-main-pull-request.yaml[R35-36]

  - name: hermetic
-    value: "false"
+    value: "true"

Evidence

The cli-stack PR PipelineRun sets hermetic to true but has no prefetch-input param in its params
list, while the cli-stack push PipelineRun includes prefetch-input and other hermetic pipelines in
this repo (model-transparency-go) also include it. This demonstrates an internal
convention/expectation that hermetic Go builds are paired with a gomod prefetch configuration.

.tekton/model-transparency-cli-stack-main-pull-request.yaml[19-40]
.tekton/model-transparency-cli-stack-main-push.yaml[18-39]
.tekton/model-transparency-go-pull-request.yaml[23-46]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The PR PipelineRun for `model-transparency-cli-stack` enables hermetic builds but does not provide a `prefetch-input` parameter, unlike the push PipelineRun and other hermetic Go PipelineRuns. This makes the hermetic configuration inconsistent and can break hermetic/offline dependency resolution.

### Issue Context
- `model-transparency-cli-stack-main-push.yaml` already uses `prefetch-input` with `{"type": "gomod", "path": "."}`.
- `model-transparency-go` pipelines (push and PR) also pair `hermetic: "true"` with `prefetch-input`.

### Fix
Add the same `prefetch-input` parameter to `.tekton/model-transparency-cli-stack-main-pull-request.yaml` (near `revision` / `hermetic`) to match the push pipeline configuration.

### Fix Focus Areas
- .tekton/model-transparency-cli-stack-main-pull-request.yaml[20-40]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗