feat: invert cli-stack build flow using pipeline wait mechanism

.tekton/fetch-tsa-certs-cli-stack-pull-request.yaml

@@ -8,7 +8,11 @@ metadata:
     build.appstudio.redhat.com/target_branch: '{{target_branch}}'
     pipelinesascode.tekton.dev/max-keep-runs: "3"
     pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch
-      == "main"
+      == "main" && ("cmd/fetch-tsa-certs/***".pathChanged() || "pkg/***".pathChanged()
+      || "Build.mak".pathChanged() || "Dockerfile.cli-stack.rh".pathChanged()
+      || "go.mod".pathChanged() || "go.sum".pathChanged()
+      || "trigger-konflux-builds.txt".pathChanged()
+      )
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: cli-stacks

.tekton/fetch-tsa-certs-cli-stack-push.yaml

@@ -7,7 +7,11 @@ metadata:
     build.appstudio.redhat.com/target_branch: '{{target_branch}}'
     pipelinesascode.tekton.dev/max-keep-runs: "3"
     pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch
-      == "main"
+      == "main" && ("cmd/fetch-tsa-certs/***".pathChanged() || "pkg/***".pathChanged()
+      || "Build.mak".pathChanged() || "Dockerfile.cli-stack.rh".pathChanged()
+      || "go.mod".pathChanged() || "go.sum".pathChanged()
+      || "trigger-konflux-builds.txt".pathChanged()
+      )
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: cli-stacks

.tekton/fetch-tsa-certs-pull-request.yaml

@@ -8,9 +8,10 @@ metadata:
     build.appstudio.redhat.com/target_branch: '{{target_branch}}'
     pipelinesascode.tekton.dev/max-keep-runs: "3"
     pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch
-      == "main" && (".tekton/fetch-tsa-certs-pull-request.yaml".pathChanged() || "cmd/fetch-tsa-certs/***".pathChanged()
-      || "pkg/***".pathChanged() || "Build.mak".pathChanged() || "Dockerfile.fetch_tsa_certs.rh".pathChanged()
-      || "go.mod".pathChanged() || "go.sum".pathChanged() || "trigger-konflux-builds.txt".pathChanged()
+      == "main" && ("cmd/fetch-tsa-certs/***".pathChanged() || "pkg/***".pathChanged()
+      || "Build.mak".pathChanged() || "Dockerfile.fetch_tsa_certs.rh".pathChanged()
+      || "go.mod".pathChanged() || "go.sum".pathChanged()
+      || "trigger-konflux-builds.txt".pathChanged()
       )
   creationTimestamp: null
   labels:
@@ -37,23 +38,18 @@ spec:
     value: "true"
   - name: hermetic
     value: "true"
-  - name: prefetch-input
-    value: '{"type": "gomod", "path": "."}'
-  - name: go_unit_test
+  - name: ALLOW_CROSS_PLATFORM_IMAGES
     value: "true"
-  - name: go_test_command
-    value: |
-      CGO_ENABLED=0 go build -trimpath -o bin/timestamp-cli ./cmd/timestamp-cli
-      CGO_ENABLED=0 go build -trimpath -o bin/timestamp-server ./cmd/timestamp-server
-      go test ./...
   - name: build-platforms
     value:
       - linux/x86_64
       - linux/arm64
       - linux/ppc64le
       - linux/s390x
-  - name: fips-check
-    value: "true"
+  - name: manager-pipelinerun-selector
+    value: "appstudio.openshift.io/application=cli-stacks,appstudio.openshift.io/component=fetch-tsa-certs-cli-stack,pipelinesascode.tekton.dev/sha={{revision}},pipelinesascode.tekton.dev/event-type in (pull_request,incoming,retest-all-comment)"
+  - name: manager-registry-url
+    value: "quay.io/securesign/fetch-tsa-certs-cli-stack"
   pipelineRef:
     params:
     - name: url
@@ -63,13 +59,6 @@ spec:
     - name: pathInRepo
       value: pipelines/docker-build-multi-platform-oci-ta.yaml
     resolver: git
-  taskRunSpecs:
-  - pipelineTaskName: run-unit-test
-    stepSpecs:
-    - computeResources:
-        limits:
-          memory: 5Gi
-      name: run-tests
   taskRunTemplate:
     serviceAccountName: build-pipeline-fetch-tsa-certs
   workspaces:

.tekton/fetch-tsa-certs-push.yaml

@@ -2,15 +2,16 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   annotations:
-    build.appstudio.openshift.io/build-nudge-files: "Dockerfile.clients.rh,Dockerfile.cli-stack.rh"
+    build.appstudio.openshift.io/build-nudge-files: "Dockerfile.clients.rh"
     build.appstudio.openshift.io/repo: https://github.com/securesign/timestamp-authority?rev={{revision}}
     build.appstudio.redhat.com/commit_sha: '{{revision}}'
     build.appstudio.redhat.com/target_branch: '{{target_branch}}'
     pipelinesascode.tekton.dev/max-keep-runs: "3"
     pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch
-      == "main" && (".tekton/fetch-tsa-certs-push.yaml".pathChanged() || "cmd/fetch-tsa-certs/***".pathChanged()
-      || "pkg/***".pathChanged() || "Build.mak".pathChanged() || "Dockerfile.fetch_tsa_certs.rh".pathChanged()
-      || "go.mod".pathChanged() || "go.sum".pathChanged() || "trigger-konflux-builds.txt".pathChanged()
+      == "main" && ("cmd/fetch-tsa-certs/***".pathChanged() || "pkg/***".pathChanged()
+      || "Build.mak".pathChanged() || "Dockerfile.fetch_tsa_certs.rh".pathChanged()
+      || "go.mod".pathChanged() || "go.sum".pathChanged()
+      || "trigger-konflux-builds.txt".pathChanged()
       )
   creationTimestamp: null
   labels:
@@ -35,23 +36,18 @@ spec:
     value: "true"
   - name: hermetic
     value: "true"
-  - name: prefetch-input
-    value: '{"type": "gomod", "path": "."}'
-  - name: go_unit_test
+  - name: ALLOW_CROSS_PLATFORM_IMAGES
     value: "true"
-  - name: go_test_command
-    value: |
-      CGO_ENABLED=0 go build -trimpath -o bin/timestamp-cli ./cmd/timestamp-cli
-      CGO_ENABLED=0 go build -trimpath -o bin/timestamp-server ./cmd/timestamp-server
-      go test ./...
   - name: build-platforms
     value:
       - linux/x86_64
       - linux/arm64
       - linux/ppc64le
       - linux/s390x
-  - name: fips-check
-    value: "true"
+  - name: manager-pipelinerun-selector
+    value: "appstudio.openshift.io/application=cli-stacks,appstudio.openshift.io/component=fetch-tsa-certs-cli-stack,pipelinesascode.tekton.dev/sha={{revision}},pipelinesascode.tekton.dev/event-type in (push,incoming,retest-all-comment)"
+  - name: manager-registry-url
+    value: "quay.io/securesign/fetch-tsa-certs-cli-stack"
   pipelineRef:
     params:
     - name: url
@@ -61,13 +57,6 @@ spec:
     - name: pathInRepo
       value: pipelines/docker-build-multi-platform-oci-ta.yaml
     resolver: git
-  taskRunSpecs:
-  - pipelineTaskName: run-unit-test
-    stepSpecs:
-    - computeResources:
-        limits:
-          memory: 5Gi
-      name: run-tests
   taskRunTemplate:
     serviceAccountName: build-pipeline-fetch-tsa-certs
   workspaces:

Build.mak

@@ -1,20 +1,40 @@
 FIPS_MODULE ?= latest
+BUILD_FLAGS = -mod=readonly -tags=no_openssl -buildvcs=false -trimpath
 
 .PHONY: fetch-tsa-certs-linux
 fetch-tsa-certs-linux: ## Build native Linux binary (FIPS)
-	env CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -mod=readonly -tags=no_openssl -buildvcs=false -o fetch_tsa_certs -trimpath ./cmd/fetch-tsa-certs
+	env CGO_ENABLED=0 GOFIPS140=v1.0.0 go build $(BUILD_FLAGS) -o fetch_tsa_certs ./cmd/fetch-tsa-certs
 
-.PHONY:
+.PHONY: fetch-tsa-certs-linux-amd64
+fetch-tsa-certs-linux-amd64: ## Build for Linux amd64
+	env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=linux GOARCH=amd64 go build $(BUILD_FLAGS) -o fetch_tsa_certs_linux_amd64 ./cmd/fetch-tsa-certs
+
+.PHONY: fetch-tsa-certs-linux-arm64
+fetch-tsa-certs-linux-arm64: ## Build for Linux arm64
+	env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=linux GOARCH=arm64 go build $(BUILD_FLAGS) -o fetch_tsa_certs_linux_arm64 ./cmd/fetch-tsa-certs
+
+.PHONY: fetch-tsa-certs-linux-ppc64le
+fetch-tsa-certs-linux-ppc64le: ## Build for Linux ppc64le
+	env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=linux GOARCH=ppc64le go build $(BUILD_FLAGS) -o fetch_tsa_certs_linux_ppc64le ./cmd/fetch-tsa-certs
+
+.PHONY: fetch-tsa-certs-linux-s390x
+fetch-tsa-certs-linux-s390x: ## Build for Linux s390x
+	env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=linux GOARCH=s390x go build $(BUILD_FLAGS) -o fetch_tsa_certs_linux_s390x ./cmd/fetch-tsa-certs
+
+.PHONY: cross-platform
 cross-platform: fetch-tsa-certs-darwin-arm64 fetch-tsa-certs-darwin-amd64 fetch-tsa-certs-windows ## Build all distributable (cross-platform) binaries
 
+.PHONY: all-platforms
+all-platforms: fetch-tsa-certs-linux-amd64 fetch-tsa-certs-linux-arm64 fetch-tsa-certs-linux-ppc64le fetch-tsa-certs-linux-s390x cross-platform ## Build all binaries for all platforms
+
 .PHONY:	fetch-tsa-certs-darwin-arm64
 fetch-tsa-certs-darwin-arm64: ## Build for mac M1
-	env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=arm64 go build -mod=readonly -buildvcs=false -o fetch_tsa_certs_darwin_arm64 -trimpath ./cmd/fetch-tsa-certs
+	env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=arm64 go build $(BUILD_FLAGS) -o fetch_tsa_certs_darwin_arm64 ./cmd/fetch-tsa-certs
 
 .PHONY: fetch-tsa-certs-darwin-amd64
 fetch-tsa-certs-darwin-amd64:  ## Build for Darwin (macOS)
-	env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=amd64 go build -mod=readonly -buildvcs=false -o fetch_tsa_certs_darwin_amd64 -trimpath ./cmd/fetch-tsa-certs
+	env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=amd64 go build $(BUILD_FLAGS) -o fetch_tsa_certs_darwin_amd64 ./cmd/fetch-tsa-certs
 
 .PHONY: fetch-tsa-certs-windows
 fetch-tsa-certs-windows: ## Build for Windows
-	env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=windows GOARCH=amd64 go build -mod=readonly -buildvcs=false -o fetch_tsa_certs_windows_amd64.exe -trimpath ./cmd/fetch-tsa-certs
+	env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=windows GOARCH=amd64 go build $(BUILD_FLAGS) -o fetch_tsa_certs_windows_amd64.exe ./cmd/fetch-tsa-certs

Dockerfile.cli-stack.rh

@@ -1,4 +1,4 @@
-FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 AS build-cross-platform
+FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 AS build-all-platforms
 ENV APP_ROOT=/opt/app-root \
     GOPATH=/opt/app-root
 
@@ -7,46 +7,38 @@ WORKDIR $APP_ROOT/src
 ADD go.mod go.sum ./
 ADD ./ ./
 
-RUN git config --global --add safe.directory /opt/app-root/src && \
-    go mod download && \
-    make -f Build.mak cross-platform
-
-FROM --platform=linux/amd64   quay.io/securesign/fetch-tsa-certs@sha256:83b5762cd5c7a041727da61038215960dbb828fd93979140be1216f45e185253 AS build-amd64
-FROM --platform=linux/arm64   quay.io/securesign/fetch-tsa-certs@sha256:83b5762cd5c7a041727da61038215960dbb828fd93979140be1216f45e185253 AS build-arm64
-FROM --platform=linux/ppc64le quay.io/securesign/fetch-tsa-certs@sha256:83b5762cd5c7a041727da61038215960dbb828fd93979140be1216f45e185253 AS build-ppc64le
-FROM --platform=linux/s390x   quay.io/securesign/fetch-tsa-certs@sha256:83b5762cd5c7a041727da61038215960dbb828fd93979140be1216f45e185253 AS build-s390x
+RUN go mod download && \
+    make -f Build.mak all-platforms
 
 FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 AS packager
 USER root
 RUN mkdir -p /binaries
 
-# fetch_tsa_certs: Native Linux binaries from each arch variant
-COPY --from=build-amd64 /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs
+COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_linux_amd64 /tmp/fetch_tsa_certs
 RUN tar -czf /binaries/fetch_tsa_certs_linux_amd64.tar.gz -C /tmp fetch_tsa_certs && \
     rm /tmp/fetch_tsa_certs
 
-COPY --from=build-arm64 /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs
+COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_linux_arm64 /tmp/fetch_tsa_certs
 RUN tar -czf /binaries/fetch_tsa_certs_linux_arm64.tar.gz -C /tmp fetch_tsa_certs && \
     rm /tmp/fetch_tsa_certs
 
-COPY --from=build-ppc64le /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs
+COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_linux_ppc64le /tmp/fetch_tsa_certs
 RUN tar -czf /binaries/fetch_tsa_certs_linux_ppc64le.tar.gz -C /tmp fetch_tsa_certs && \
     rm /tmp/fetch_tsa_certs
 
-COPY --from=build-s390x /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs
+COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_linux_s390x /tmp/fetch_tsa_certs
 RUN tar -czf /binaries/fetch_tsa_certs_linux_s390x.tar.gz -C /tmp fetch_tsa_certs && \
     rm /tmp/fetch_tsa_certs
 
-# fetch_tsa_certs: Cross-compiled binaries
-COPY --from=build-cross-platform /opt/app-root/src/fetch_tsa_certs_darwin_amd64 /tmp/fetch_tsa_certs_darwin_amd64
+COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_darwin_amd64 /tmp/fetch_tsa_certs_darwin_amd64
 RUN tar -czf /binaries/fetch_tsa_certs_darwin_amd64.tar.gz -C /tmp fetch_tsa_certs_darwin_amd64 && \
     rm /tmp/fetch_tsa_certs_darwin_amd64
 
-COPY --from=build-cross-platform /opt/app-root/src/fetch_tsa_certs_darwin_arm64 /tmp/fetch_tsa_certs_darwin_arm64
+COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_darwin_arm64 /tmp/fetch_tsa_certs_darwin_arm64
 RUN tar -czf /binaries/fetch_tsa_certs_darwin_arm64.tar.gz -C /tmp fetch_tsa_certs_darwin_arm64 && \
     rm /tmp/fetch_tsa_certs_darwin_arm64
 
-COPY --from=build-cross-platform /opt/app-root/src/fetch_tsa_certs_windows_amd64.exe /tmp/fetch_tsa_certs_windows_amd64.exe
+COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_windows_amd64.exe /tmp/fetch_tsa_certs_windows_amd64.exe
 RUN tar -czf /binaries/fetch_tsa_certs_windows_amd64.tar.gz -C /tmp fetch_tsa_certs_windows_amd64.exe && \
     rm /tmp/fetch_tsa_certs_windows_amd64.exe
 
@@ -65,6 +57,6 @@ LABEL com.redhat.component="fetch-tsa-certs-cli-stack"
 LABEL name="rhtas/fetch-tsa-certs-cli-stack"
 
 COPY --from=packager /binaries/ /binaries/
-COPY --from=build-amd64 /licenses/ /licenses/
+COPY --from=build-all-platforms /opt/app-root/src/LICENSE /licenses/license.txt
 
 USER 65532:65532

Dockerfile.fetch_tsa_certs.rh

@@ -1,22 +1,14 @@
-FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 as build-env
-ENV APP_ROOT=/opt/app-root
-ENV GOPATH=$APP_ROOT
-ENV CGO_ENABLED=0
-ENV GOFIPS140=v1.0.0
-WORKDIR $APP_ROOT/src/
+ARG IMG=quay.io/securesign/fetch-tsa-certs-cli-stack:latest
+FROM --platform=linux/amd64 ${IMG} AS cli-stack
 
-ADD go.mod go.sum $APP_ROOT/src/
-RUN go mod download
-
-ADD ./cmd/ $APP_ROOT/src/cmd/
-ADD ./pkg/ $APP_ROOT/src/pkg/
-ADD ./Build.mak $APP_ROOT/src/Build.mak
-
-RUN make -f Build.mak fetch-tsa-certs-linux
+FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 AS extractor
+USER root
+ARG TARGETARCH
+COPY --from=cli-stack /binaries/ /tmp/binaries/
+RUN tar -xzf /tmp/binaries/fetch_tsa_certs_linux_${TARGETARCH}.tar.gz -C /tmp/ && \
+    rm -rf /tmp/binaries
 
 FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:83006d535923fcf1345067873524a3980316f51794f01d8655be55d6e9387183
-ENV APP_ROOT=/opt/app-root
-WORKDIR $APP_ROOT/src/
 
 LABEL description="The fetch_tsa_certs binary is a cli used to configure the kms and tink signer types for Timestamp Authority."
 LABEL io.k8s.description="The fetch_tsa_certs binary is a cli used to configure the kms and tink signer types for Timestamp Authority."
@@ -26,9 +18,8 @@ LABEL summary="Provides fetch_tsa_certs images."
 LABEL com.redhat.component="fetch_tsa_certs"
 LABEL name="rhtas/fetch-tsa-certs-rhel9"
 
-COPY LICENSE /licenses/license.txt
-
-COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs /usr/local/bin/fetch_tsa_certs
+COPY --from=cli-stack /licenses/license.txt /licenses/license.txt
+COPY --from=extractor /tmp/fetch_tsa_certs /usr/local/bin/fetch_tsa_certs
 
 USER 65532:65532