buildah 0.8 #1282

jimmyjones2 · 2024-06-22T18:56:37Z

Don't use interpolation (move to env)
Easier way of specifying build args - previously would have to use BUILD_EXTRA_ARGS and quote them very carefully
Add warning for BUILD_EXTRA_ARGS and PUSH_EXTRA_ARGS that inputs need to be sanitized

e.g. now the following are correctly passed as Dockerfile build arguments:

        - name: BUILD_ARGS
          value:
            - |
                foo=b\"a'z"u uu
            - baz=8888$(echo foo)ssss`ssss` -v a:b

Changes

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

Follows the authoring recommendations
Includes docs (if user facing)
Includes tests (for new tasks or changed functionality)
- See the end-to-end testing documentation for guidance and CI details.
Meets the Tekton contributor standards (including functionality, content, code)
[] Commit messages follow commit message best practices
Has a kind label. You can add one by adding a comment on this PR that
contains /kind <type>. Valid types are bug, cleanup, design, documentation,
feature, flake, misc, question, tep
Complies with Catalog Organization TEP, see example. Note An issue has been filed to automate this validation
- File path follows <kind>/<name>/<version>/name.yaml
- Has README.md at <kind>/<name>/<version>/README.md
- Has mandatory metadata.labels - app.kubernetes.io/version the same as the <version> of the resource
- Has mandatory metadata.annotations tekton.dev/pipelines.minVersion
- mandatory spec.description follows the convention
```
  ```
  
    spec:
      description: >-
        one line summary of the resource
  
        Paragraph(s) to describe the resource.
  ```
```

See the contribution guide for more details.

tekton-robot · 2024-06-22T18:56:47Z

Hi @jimmyjones2. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tekton-robot · 2024-06-22T18:57:14Z

Diff between version 0.7 and 0.8

diff --git a/task/buildah/0.7/README.md b/task/buildah/0.8/README.md
index 363e22e..c7ef355 100644
--- a/task/buildah/0.7/README.md
+++ b/task/buildah/0.8/README.md
@@ -10,7 +10,7 @@ to assemble a container image, then pushes that image to a container registry.
 ## Install the Task
 
 ```
-kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/buildah/0.7/raw
+kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/buildah/0.8/raw
 ```
 
 ## Parameters
@@ -27,10 +27,13 @@ kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/buildah/0.7/
 * **FORMAT**: The format of the built container, oci or docker (_default:_
  `oci`)
 * **BUILD_EXTRA_ARGS**: Extra parameters passed for the build command when
-  building images. (_default:_ `""`)
+  building images. WARNING - must be sanitized to avoid command injection 
+  (_default:_ `""`)
 * **PUSH_EXTRA_ARGS**: Extra parameters passed for the push command when
-  pushing images. (_default:_ `""`)
+  pushing images. WARNING - must be sanitized to avoid command injection
+  (_default:_ `""`)
 * **SKIP_PUSH**: Skip pushing the built image (_default:_ `false`)
+* **BUILD_ARGS**: Dockerfile build arguments, array of key=value (_default:_ [""])
 
 ## Results
 
diff --git a/task/buildah/0.7/buildah.yaml b/task/buildah/0.8/buildah.yaml
index 3ab4f77..189b687 100644
--- a/task/buildah/0.7/buildah.yaml
+++ b/task/buildah/0.8/buildah.yaml
@@ -4,7 +4,7 @@ kind: Task
 metadata:
   name: buildah
   labels:
-    app.kubernetes.io/version: "0.7"
+    app.kubernetes.io/version: "0.8"
   annotations:
     tekton.dev/categories: Image Build
     tekton.dev/pipelines.minVersion: "0.17.0"
@@ -44,15 +44,20 @@ spec:
     description: The format of the built container, oci or docker
     default: "oci"
   - name: BUILD_EXTRA_ARGS
-    description: Extra parameters passed for the build command when building images.
+    description: Extra parameters passed for the build command when building images. WARNING - must be sanitized to avoid command injection
     default: ""
   - name: PUSH_EXTRA_ARGS
-    description: Extra parameters passed for the push command when pushing images.
+    description: Extra parameters passed for the push command when pushing images. WARNING - must be sanitized to avoid command injection
     type: string
     default: ""
   - name: SKIP_PUSH
     description: Skip pushing the built image
     default: "false"
+  - name: BUILD_ARGS
+    description: Dockerfile build arguments, array of key=value
+    type: array
+    default:
+    - ""
   workspaces:
   - name: source
   - name: sslcertdir
@@ -72,22 +77,48 @@ spec:
   - name: build-and-push
     image: $(params.BUILDER_IMAGE)
     workingDir: $(workspaces.source.path)
+    env:
+    - name: PARAM_IMAGE
+      value: $(params.IMAGE)
+    - name: PARAM_STORAGE_DRIVER
+      value: $(params.STORAGE_DRIVER)
+    - name: PARAM_DOCKERFILE
+      value: $(params.DOCKERFILE)
+    - name: PARAM_CONTEXT
+      value: $(params.CONTEXT)
+    - name: PARAM_TLSVERIFY
+      value: $(params.TLSVERIFY)
+    - name: PARAM_FORMAT
+      value: $(params.FORMAT)
+    - name: PARAM_BUILD_EXTRA_ARGS
+      value: $(params.BUILD_EXTRA_ARGS)
+    - name: PARAM_PUSH_EXTRA_ARGS
+      value: $(params.PUSH_EXTRA_ARGS)
+    - name: PARAM_SKIP_PUSH
+      value: $(params.SKIP_PUSH)
+    args:
+    - $(params.BUILD_ARGS[*])
     script: |
+      BUILD_ARGS=()
+      for buildarg in "$@"
+      do
+        BUILD_ARGS+=("--build-arg=$buildarg")
+      done
       [ "$(workspaces.sslcertdir.bound)" = "true" ] && CERT_DIR_FLAG="--cert-dir=$(workspaces.sslcertdir.path)"
       [ "$(workspaces.dockerconfig.bound)" = "true" ] && DOCKER_CONFIG="$(workspaces.dockerconfig.path)" && export DOCKER_CONFIG
       # build the image (CERT_DIR_FLAG should be omitted if empty and BUILD_EXTRA_ARGS can contain multiple args)
       # shellcheck disable=SC2046,SC2086
-      buildah ${CERT_DIR_FLAG} "--storage-driver=$(params.STORAGE_DRIVER)" bud $(params.BUILD_EXTRA_ARGS) \
-        "--format=$(params.FORMAT)" "--tls-verify=$(params.TLSVERIFY)" \
-        -f "$(params.DOCKERFILE)" -t "$(params.IMAGE)" "$(params.CONTEXT)"
-      [ "$(params.SKIP_PUSH)" = "true" ] && echo "Push skipped" && exit 0
+      buildah ${CERT_DIR_FLAG} "--storage-driver=${PARAM_STORAGE_DRIVER}" bud "${BUILD_ARGS[@]}" ${PARAM_BUILD_EXTRA_ARGS} \
+        "--format=${PARAM_FORMAT}" "--tls-verify=${PARAM_TLSVERIFY}" \
+        -f "${PARAM_DOCKERFILE}" -t "${PARAM_IMAGE}" "${PARAM_CONTEXT}"
+      [ "${PARAM_SKIP_PUSH}" = "true" ] && echo "Push skipped" && exit 0
       # push the image (CERT_DIR_FLAG should be omitted if empty and PUSH_EXTRA_ARGS can contain multiple args)
       # shellcheck disable=SC2046,SC2086
-      buildah ${CERT_DIR_FLAG} "--storage-driver=$(params.STORAGE_DRIVER)" push $(params.PUSH_EXTRA_ARGS) \
-        "--tls-verify=$(params.TLSVERIFY)" --digestfile /tmp/image-digest "$(params.IMAGE)" \
-        "docker://$(params.IMAGE)"
+      buildah ${CERT_DIR_FLAG} "--storage-driver=${PARAM_STORAGE_DRIVER}" push ${PARAM_PUSH_EXTRA_ARGS} \
+        "--tls-verify=${PARAM_TLSVERIFY}" --digestfile /tmp/image-digest "${PARAM_IMAGE}" \
+        "docker://${PARAM_IMAGE}"
       tee "$(results.IMAGE_DIGEST.path)" < /tmp/image-digest
-      printf '%s' "$(params.IMAGE)" | tee "$(results.IMAGE_URL.path)"
+      printf '%s' "${PARAM_IMAGE}" | tee "$(results.IMAGE_URL.path)"
     volumeMounts:
     - name: varlibcontainers
       mountPath: /var/lib/containers

tekton-robot · 2024-06-22T18:57:21Z

Catlin Output

FILE: task/buildah/0.8/buildah.yaml
WARN : Step "build-and-push" uses image "$(params.BUILDER_IMAGE)" that contains variables; skipping validation

Catlin script lint Output

ERROR: /usr/bin/shellcheck, [-s sh] failed:

In buildah-build-and-push line 2:
BUILD_ARGS=()
           ^-- SC3030 (warning): In POSIX sh, arrays are undefined.


In buildah-build-and-push line 5:
  BUILD_ARGS+=("--build-arg=$buildarg")
  ^--------^ SC3024 (warning): In POSIX sh, += is undefined.
              ^-----------------------^ SC3030 (warning): In POSIX sh, arrays are undefined.


In buildah-build-and-push line 11:
buildah ${CERT_DIR_FLAG} "--storage-driver=${PARAM_STORAGE_DRIVER}" bud "${BUILD_ARGS[@]}" ${PARAM_BUILD_EXTRA_ARGS} \
                                                                         ^--------------^ SC3054 (warning): In POSIX sh, array references are undefined.

For more information:
  https://www.shellcheck.net/wiki/SC3024 -- In POSIX sh, += is undefined.
  https://www.shellcheck.net/wiki/SC3030 -- In POSIX sh, arrays are undefined.
  https://www.shellcheck.net/wiki/SC3054 -- In POSIX sh, array references are...

ERROR: /bin/sh, [-n] failed:
buildah-build-and-push: line 2: syntax error: unexpected "("

jimmyjones2 · 2024-06-22T18:59:05Z

@vdemeester @vinamra28 Can you review please?

vdemeester · 2024-07-03T08:49:12Z

/ok-to-test

vdemeester

cc @vinamra28

vinamra28 · 2024-06-24T11:28:18Z

task/buildah/0.8/buildah.yaml

@@ -0,0 +1,129 @@
+---
+apiVersion: tekton.dev/v1beta1


I wonder if we should make this tekton.dev/v1 ?

vinamra28 · 2024-06-24T11:28:57Z

task/buildah/0.8/buildah.yaml

+    app.kubernetes.io/version: "0.8"
+  annotations:
+    tekton.dev/categories: Image Build
+    tekton.dev/pipelines.minVersion: "0.17.0"


If we are doing tekton.dev/v1, then we should bump this to "0.50.0"

vinamra28 · 2024-06-24T11:29:20Z

task/buildah/0.8/samples/dockerconfig.yaml

+      }
+    }
+---
+apiVersion: tekton.dev/v1beta1


same as above

vinamra28 · 2024-06-24T11:29:39Z

task/buildah/0.8/samples/openshift-internal-registry.yaml

+    ....................................................
+    -----END CERTIFICATE-----
+---
+apiVersion: tekton.dev/v1beta1


same as above

vinamra28 · 2024-06-24T11:29:55Z

task/buildah/0.8/tests/run.yaml

@@ -0,0 +1,126 @@
+---
+apiVersion: tekton.dev/v1beta1


same as above

tekton-robot · 2024-07-03T21:29:20Z

Diff between version 0.7 and 0.8

diff --git a/task/buildah/0.7/README.md b/task/buildah/0.8/README.md
index 363e22e..aa5047c 100644
--- a/task/buildah/0.7/README.md
+++ b/task/buildah/0.8/README.md
@@ -10,7 +10,7 @@ to assemble a container image, then pushes that image to a container registry.
 ## Install the Task
 
 ```
-kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/buildah/0.7/raw
+kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/buildah/0.8/raw
 ```
 
 ## Parameters
@@ -27,10 +27,13 @@ kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/buildah/0.7/
 * **FORMAT**: The format of the built container, oci or docker (_default:_
  `oci`)
 * **BUILD_EXTRA_ARGS**: Extra parameters passed for the build command when
-  building images. (_default:_ `""`)
+  building images. WARNING - must be sanitized to avoid command injection 
+  (_default:_ `""`)
 * **PUSH_EXTRA_ARGS**: Extra parameters passed for the push command when
-  pushing images. (_default:_ `""`)
+  pushing images. WARNING - must be sanitized to avoid command injection
+  (_default:_ `""`)
 * **SKIP_PUSH**: Skip pushing the built image (_default:_ `false`)
+* **BUILD_ARGS**: Dockerfile build arguments, array of key=value (_default:_ [""])
 
 ## Results
 
@@ -53,7 +56,7 @@ This TaskRun runs the Task to fetch a Git repo, and build and push a container
 image using Buildah.
 
 ```yaml
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: TaskRun
 metadata:
   name: buildah-build-my-repo
diff --git a/task/buildah/0.7/buildah.yaml b/task/buildah/0.8/buildah.yaml
index 3ab4f77..7866810 100644
--- a/task/buildah/0.7/buildah.yaml
+++ b/task/buildah/0.8/buildah.yaml
@@ -1,13 +1,13 @@
 ---
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: Task
 metadata:
   name: buildah
   labels:
-    app.kubernetes.io/version: "0.7"
+    app.kubernetes.io/version: "0.8"
   annotations:
     tekton.dev/categories: Image Build
-    tekton.dev/pipelines.minVersion: "0.17.0"
+    tekton.dev/pipelines.minVersion: "0.50.0"
     tekton.dev/tags: image-build
     tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64"
     tekton.dev/displayName: buildah
@@ -44,15 +44,20 @@ spec:
     description: The format of the built container, oci or docker
     default: "oci"
   - name: BUILD_EXTRA_ARGS
-    description: Extra parameters passed for the build command when building images.
+    description: Extra parameters passed for the build command when building images. WARNING - must be sanitized to avoid command injection
     default: ""
   - name: PUSH_EXTRA_ARGS
-    description: Extra parameters passed for the push command when pushing images.
+    description: Extra parameters passed for the push command when pushing images. WARNING - must be sanitized to avoid command injection
     type: string
     default: ""
   - name: SKIP_PUSH
     description: Skip pushing the built image
     default: "false"
+  - name: BUILD_ARGS
+    description: Dockerfile build arguments, array of key=value
+    type: array
+    default:
+    - ""
   workspaces:
   - name: source
   - name: sslcertdir
@@ -72,22 +77,48 @@ spec:
   - name: build-and-push
     image: $(params.BUILDER_IMAGE)
     workingDir: $(workspaces.source.path)
+    env:
+    - name: PARAM_IMAGE
+      value: $(params.IMAGE)
+    - name: PARAM_STORAGE_DRIVER
+      value: $(params.STORAGE_DRIVER)
+    - name: PARAM_DOCKERFILE
+      value: $(params.DOCKERFILE)
+    - name: PARAM_CONTEXT
+      value: $(params.CONTEXT)
+    - name: PARAM_TLSVERIFY
+      value: $(params.TLSVERIFY)
+    - name: PARAM_FORMAT
+      value: $(params.FORMAT)
+    - name: PARAM_BUILD_EXTRA_ARGS
+      value: $(params.BUILD_EXTRA_ARGS)
+    - name: PARAM_PUSH_EXTRA_ARGS
+      value: $(params.PUSH_EXTRA_ARGS)
+    - name: PARAM_SKIP_PUSH
+      value: $(params.SKIP_PUSH)
+    args:
+    - $(params.BUILD_ARGS[*])
     script: |
+      BUILD_ARGS=()
+      for buildarg in "$@"
+      do
+        BUILD_ARGS+=("--build-arg=$buildarg")
+      done
       [ "$(workspaces.sslcertdir.bound)" = "true" ] && CERT_DIR_FLAG="--cert-dir=$(workspaces.sslcertdir.path)"
       [ "$(workspaces.dockerconfig.bound)" = "true" ] && DOCKER_CONFIG="$(workspaces.dockerconfig.path)" && export DOCKER_CONFIG
       # build the image (CERT_DIR_FLAG should be omitted if empty and BUILD_EXTRA_ARGS can contain multiple args)
       # shellcheck disable=SC2046,SC2086
-      buildah ${CERT_DIR_FLAG} "--storage-driver=$(params.STORAGE_DRIVER)" bud $(params.BUILD_EXTRA_ARGS) \
-        "--format=$(params.FORMAT)" "--tls-verify=$(params.TLSVERIFY)" \
-        -f "$(params.DOCKERFILE)" -t "$(params.IMAGE)" "$(params.CONTEXT)"
-      [ "$(params.SKIP_PUSH)" = "true" ] && echo "Push skipped" && exit 0
+      buildah ${CERT_DIR_FLAG} "--storage-driver=${PARAM_STORAGE_DRIVER}" bud "${BUILD_ARGS[@]}" ${PARAM_BUILD_EXTRA_ARGS} \
+        "--format=${PARAM_FORMAT}" "--tls-verify=${PARAM_TLSVERIFY}" \
+        -f "${PARAM_DOCKERFILE}" -t "${PARAM_IMAGE}" "${PARAM_CONTEXT}"
+      [ "${PARAM_SKIP_PUSH}" = "true" ] && echo "Push skipped" && exit 0
       # push the image (CERT_DIR_FLAG should be omitted if empty and PUSH_EXTRA_ARGS can contain multiple args)
       # shellcheck disable=SC2046,SC2086
-      buildah ${CERT_DIR_FLAG} "--storage-driver=$(params.STORAGE_DRIVER)" push $(params.PUSH_EXTRA_ARGS) \
-        "--tls-verify=$(params.TLSVERIFY)" --digestfile /tmp/image-digest "$(params.IMAGE)" \
-        "docker://$(params.IMAGE)"
+      buildah ${CERT_DIR_FLAG} "--storage-driver=${PARAM_STORAGE_DRIVER}" push ${PARAM_PUSH_EXTRA_ARGS} \
+        "--tls-verify=${PARAM_TLSVERIFY}" --digestfile /tmp/image-digest "${PARAM_IMAGE}" \
+        "docker://${PARAM_IMAGE}"
       tee "$(results.IMAGE_DIGEST.path)" < /tmp/image-digest
-      printf '%s' "$(params.IMAGE)" | tee "$(results.IMAGE_URL.path)"
+      printf '%s' "${PARAM_IMAGE}" | tee "$(results.IMAGE_URL.path)"
     volumeMounts:
     - name: varlibcontainers
       mountPath: /var/lib/containers
diff --git a/task/buildah/0.7/samples/dockerconfig.yaml b/task/buildah/0.8/samples/dockerconfig.yaml
index fb23184..9002eb5 100644
--- a/task/buildah/0.7/samples/dockerconfig.yaml
+++ b/task/buildah/0.8/samples/dockerconfig.yaml
@@ -14,7 +14,7 @@ stringData:
       }
     }
 ---
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: buildah-test-pipeline-run
diff --git a/task/buildah/0.7/samples/openshift-internal-registry.yaml b/task/buildah/0.8/samples/openshift-internal-registry.yaml
index f2c6075..491406b 100644
--- a/task/buildah/0.7/samples/openshift-internal-registry.yaml
+++ b/task/buildah/0.8/samples/openshift-internal-registry.yaml
@@ -32,7 +32,7 @@ data:
     ....................................................
     -----END CERTIFICATE-----
 ---
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   generateName: buildah-custom-ca-
diff --git a/task/buildah/0.7/tests/run.yaml b/task/buildah/0.8/tests/run.yaml
index 4f1a074..cf48756 100644
--- a/task/buildah/0.7/tests/run.yaml
+++ b/task/buildah/0.8/tests/run.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: buildah-test-pipeline-run
@@ -69,7 +69,7 @@ spec:
       - key: ca.crt
         path: ca.crt
 ---
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: buildah-test-skip-push-pipeline-run

jimmyjones2 · 2024-07-03T21:36:13Z

@vinamra28 Converted to v1

vinamra28 · 2024-07-05T15:53:28Z

task/buildah/0.8/buildah.yaml

+  - name: BUILD_ARGS
+    description: Dockerfile build arguments, array of key=value
+    type: array
+    default:


BUILD_EXTRA_ARGS is already there, do we still need this?

BUILD_ARGS can only be used to set ARGs in the Dockerfile (safely and handling escaping).

BUILD_EXTRA_ARGS is still necessary to allow passing arbitrary extra command line options to the buildah build command (accepting the risk and potential escaping requirements).

ack,lastly, can you please squash the commits? will merge it

* don't use interpolation * easier way of specifying build args * move to v1 resources

tekton-robot · 2024-07-15T12:15:46Z

Diff between version 0.7 and 0.8

diff --git a/task/buildah/0.7/README.md b/task/buildah/0.8/README.md
index 363e22e..aa5047c 100644
--- a/task/buildah/0.7/README.md
+++ b/task/buildah/0.8/README.md
@@ -10,7 +10,7 @@ to assemble a container image, then pushes that image to a container registry.
 ## Install the Task
 
 ```
-kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/buildah/0.7/raw
+kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/buildah/0.8/raw
 ```
 
 ## Parameters
@@ -27,10 +27,13 @@ kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/buildah/0.7/
 * **FORMAT**: The format of the built container, oci or docker (_default:_
  `oci`)
 * **BUILD_EXTRA_ARGS**: Extra parameters passed for the build command when
-  building images. (_default:_ `""`)
+  building images. WARNING - must be sanitized to avoid command injection 
+  (_default:_ `""`)
 * **PUSH_EXTRA_ARGS**: Extra parameters passed for the push command when
-  pushing images. (_default:_ `""`)
+  pushing images. WARNING - must be sanitized to avoid command injection
+  (_default:_ `""`)
 * **SKIP_PUSH**: Skip pushing the built image (_default:_ `false`)
+* **BUILD_ARGS**: Dockerfile build arguments, array of key=value (_default:_ [""])
 
 ## Results
 
@@ -53,7 +56,7 @@ This TaskRun runs the Task to fetch a Git repo, and build and push a container
 image using Buildah.
 
 ```yaml
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: TaskRun
 metadata:
   name: buildah-build-my-repo
diff --git a/task/buildah/0.7/buildah.yaml b/task/buildah/0.8/buildah.yaml
index 3ab4f77..7866810 100644
--- a/task/buildah/0.7/buildah.yaml
+++ b/task/buildah/0.8/buildah.yaml
@@ -1,13 +1,13 @@
 ---
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: Task
 metadata:
   name: buildah
   labels:
-    app.kubernetes.io/version: "0.7"
+    app.kubernetes.io/version: "0.8"
   annotations:
     tekton.dev/categories: Image Build
-    tekton.dev/pipelines.minVersion: "0.17.0"
+    tekton.dev/pipelines.minVersion: "0.50.0"
     tekton.dev/tags: image-build
     tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64"
     tekton.dev/displayName: buildah
@@ -44,15 +44,20 @@ spec:
     description: The format of the built container, oci or docker
     default: "oci"
   - name: BUILD_EXTRA_ARGS
-    description: Extra parameters passed for the build command when building images.
+    description: Extra parameters passed for the build command when building images. WARNING - must be sanitized to avoid command injection
     default: ""
   - name: PUSH_EXTRA_ARGS
-    description: Extra parameters passed for the push command when pushing images.
+    description: Extra parameters passed for the push command when pushing images. WARNING - must be sanitized to avoid command injection
     type: string
     default: ""
   - name: SKIP_PUSH
     description: Skip pushing the built image
     default: "false"
+  - name: BUILD_ARGS
+    description: Dockerfile build arguments, array of key=value
+    type: array
+    default:
+    - ""
   workspaces:
   - name: source
   - name: sslcertdir
@@ -72,22 +77,48 @@ spec:
   - name: build-and-push
     image: $(params.BUILDER_IMAGE)
     workingDir: $(workspaces.source.path)
+    env:
+    - name: PARAM_IMAGE
+      value: $(params.IMAGE)
+    - name: PARAM_STORAGE_DRIVER
+      value: $(params.STORAGE_DRIVER)
+    - name: PARAM_DOCKERFILE
+      value: $(params.DOCKERFILE)
+    - name: PARAM_CONTEXT
+      value: $(params.CONTEXT)
+    - name: PARAM_TLSVERIFY
+      value: $(params.TLSVERIFY)
+    - name: PARAM_FORMAT
+      value: $(params.FORMAT)
+    - name: PARAM_BUILD_EXTRA_ARGS
+      value: $(params.BUILD_EXTRA_ARGS)
+    - name: PARAM_PUSH_EXTRA_ARGS
+      value: $(params.PUSH_EXTRA_ARGS)
+    - name: PARAM_SKIP_PUSH
+      value: $(params.SKIP_PUSH)
+    args:
+    - $(params.BUILD_ARGS[*])
     script: |
+      BUILD_ARGS=()
+      for buildarg in "$@"
+      do
+        BUILD_ARGS+=("--build-arg=$buildarg")
+      done
       [ "$(workspaces.sslcertdir.bound)" = "true" ] && CERT_DIR_FLAG="--cert-dir=$(workspaces.sslcertdir.path)"
       [ "$(workspaces.dockerconfig.bound)" = "true" ] && DOCKER_CONFIG="$(workspaces.dockerconfig.path)" && export DOCKER_CONFIG
       # build the image (CERT_DIR_FLAG should be omitted if empty and BUILD_EXTRA_ARGS can contain multiple args)
       # shellcheck disable=SC2046,SC2086
-      buildah ${CERT_DIR_FLAG} "--storage-driver=$(params.STORAGE_DRIVER)" bud $(params.BUILD_EXTRA_ARGS) \
-        "--format=$(params.FORMAT)" "--tls-verify=$(params.TLSVERIFY)" \
-        -f "$(params.DOCKERFILE)" -t "$(params.IMAGE)" "$(params.CONTEXT)"
-      [ "$(params.SKIP_PUSH)" = "true" ] && echo "Push skipped" && exit 0
+      buildah ${CERT_DIR_FLAG} "--storage-driver=${PARAM_STORAGE_DRIVER}" bud "${BUILD_ARGS[@]}" ${PARAM_BUILD_EXTRA_ARGS} \
+        "--format=${PARAM_FORMAT}" "--tls-verify=${PARAM_TLSVERIFY}" \
+        -f "${PARAM_DOCKERFILE}" -t "${PARAM_IMAGE}" "${PARAM_CONTEXT}"
+      [ "${PARAM_SKIP_PUSH}" = "true" ] && echo "Push skipped" && exit 0
       # push the image (CERT_DIR_FLAG should be omitted if empty and PUSH_EXTRA_ARGS can contain multiple args)
       # shellcheck disable=SC2046,SC2086
-      buildah ${CERT_DIR_FLAG} "--storage-driver=$(params.STORAGE_DRIVER)" push $(params.PUSH_EXTRA_ARGS) \
-        "--tls-verify=$(params.TLSVERIFY)" --digestfile /tmp/image-digest "$(params.IMAGE)" \
-        "docker://$(params.IMAGE)"
+      buildah ${CERT_DIR_FLAG} "--storage-driver=${PARAM_STORAGE_DRIVER}" push ${PARAM_PUSH_EXTRA_ARGS} \
+        "--tls-verify=${PARAM_TLSVERIFY}" --digestfile /tmp/image-digest "${PARAM_IMAGE}" \
+        "docker://${PARAM_IMAGE}"
       tee "$(results.IMAGE_DIGEST.path)" < /tmp/image-digest
-      printf '%s' "$(params.IMAGE)" | tee "$(results.IMAGE_URL.path)"
+      printf '%s' "${PARAM_IMAGE}" | tee "$(results.IMAGE_URL.path)"
     volumeMounts:
     - name: varlibcontainers
       mountPath: /var/lib/containers
diff --git a/task/buildah/0.7/samples/dockerconfig.yaml b/task/buildah/0.8/samples/dockerconfig.yaml
index fb23184..9002eb5 100644
--- a/task/buildah/0.7/samples/dockerconfig.yaml
+++ b/task/buildah/0.8/samples/dockerconfig.yaml
@@ -14,7 +14,7 @@ stringData:
       }
     }
 ---
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: buildah-test-pipeline-run
diff --git a/task/buildah/0.7/samples/openshift-internal-registry.yaml b/task/buildah/0.8/samples/openshift-internal-registry.yaml
index f2c6075..491406b 100644
--- a/task/buildah/0.7/samples/openshift-internal-registry.yaml
+++ b/task/buildah/0.8/samples/openshift-internal-registry.yaml
@@ -32,7 +32,7 @@ data:
     ....................................................
     -----END CERTIFICATE-----
 ---
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   generateName: buildah-custom-ca-
diff --git a/task/buildah/0.7/tests/run.yaml b/task/buildah/0.8/tests/run.yaml
index 4f1a074..cf48756 100644
--- a/task/buildah/0.7/tests/run.yaml
+++ b/task/buildah/0.8/tests/run.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: buildah-test-pipeline-run
@@ -69,7 +69,7 @@ spec:
       - key: ca.crt
         path: ca.crt
 ---
-apiVersion: tekton.dev/v1beta1
+apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: buildah-test-skip-push-pipeline-run

jimmyjones2 · 2024-07-15T12:23:33Z

@vinamra28 Squashed and ready to merge :)

vinamra28 · 2024-07-15T16:30:58Z

/lgtm
/approve

tekton-robot · 2024-07-15T16:31:02Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester, vinamra28

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~task/buildah/OWNERS~~ [vdemeester,vinamra28]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tekton-robot requested review from chmouel and imjasonh June 22, 2024 18:56

tekton-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 22, 2024

tekton-robot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Jun 22, 2024

tekton-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 3, 2024

vdemeester approved these changes Jul 3, 2024

View reviewed changes

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 3, 2024

vinamra28 reviewed Jul 3, 2024

View reviewed changes

vinamra28 reviewed Jul 5, 2024

View reviewed changes

buildah 0.8

7646210

* don't use interpolation * easier way of specifying build args * move to v1 resources

jimmyjones2 force-pushed the buildah-0.8 branch from d8bfe26 to 7646210 Compare July 15, 2024 12:15

tekton-robot assigned vinamra28 Jul 15, 2024

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 15, 2024

tekton-robot merged commit 82a2a61 into tektoncd:main Jul 15, 2024
6 checks passed

jimmyjones2 deleted the buildah-0.8 branch July 15, 2024 19:05

jimmyjones2 mentioned this pull request Jul 18, 2024

Port changes from catalog buildah 0.8 tektoncd/operator#2253

Closed

4 tasks

jimmyjones2 mentioned this pull request Aug 1, 2024

Merge upstream buildan 0.7 and 0.8 changes openshift-pipelines/task-containers#94

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

buildah 0.8 #1282

buildah 0.8 #1282

jimmyjones2 commented Jun 22, 2024

tekton-robot commented Jun 22, 2024

tekton-robot commented Jun 22, 2024

tekton-robot commented Jun 22, 2024

jimmyjones2 commented Jun 22, 2024

vdemeester commented Jul 3, 2024

vdemeester left a comment

vinamra28 Jun 24, 2024

vinamra28 Jun 24, 2024

vinamra28 Jun 24, 2024

vinamra28 Jun 24, 2024

vinamra28 Jun 24, 2024

tekton-robot commented Jul 3, 2024

jimmyjones2 commented Jul 3, 2024

vinamra28 Jul 5, 2024

jimmyjones2 Jul 5, 2024 •

edited

Loading

vinamra28 Jul 15, 2024

tekton-robot commented Jul 15, 2024

jimmyjones2 commented Jul 15, 2024

vinamra28 commented Jul 15, 2024

tekton-robot commented Jul 15, 2024

buildah 0.8 #1282

buildah 0.8 #1282

Conversation

jimmyjones2 commented Jun 22, 2024

Changes

Submitter Checklist

tekton-robot commented Jun 22, 2024

tekton-robot commented Jun 22, 2024

tekton-robot commented Jun 22, 2024

jimmyjones2 commented Jun 22, 2024

vdemeester commented Jul 3, 2024

vdemeester left a comment

Choose a reason for hiding this comment

vinamra28 Jun 24, 2024

Choose a reason for hiding this comment

vinamra28 Jun 24, 2024

Choose a reason for hiding this comment

vinamra28 Jun 24, 2024

Choose a reason for hiding this comment

vinamra28 Jun 24, 2024

Choose a reason for hiding this comment

vinamra28 Jun 24, 2024

Choose a reason for hiding this comment

tekton-robot commented Jul 3, 2024

jimmyjones2 commented Jul 3, 2024

vinamra28 Jul 5, 2024

Choose a reason for hiding this comment

jimmyjones2 Jul 5, 2024 • edited Loading

Choose a reason for hiding this comment

vinamra28 Jul 15, 2024

Choose a reason for hiding this comment

tekton-robot commented Jul 15, 2024

jimmyjones2 commented Jul 15, 2024

vinamra28 commented Jul 15, 2024

tekton-robot commented Jul 15, 2024

jimmyjones2 Jul 5, 2024 •

edited

Loading