Add enterprise-contract pipeline definition to cli/pipelines

[jsmid1]

Move the enterprise-contract integration pipeline source of truth from build-definitions to cli/pipelines/, consistent with how task definitions are already maintained in cli/tasks/. This enables publishing to conforma/tekton-catalog alongside existing tasks.

Ref: https://issues.redhat.com/browse/EC-1942

[qodo-for-conforma]

PR Summary by Qodo

Add Enterprise Contract Tekton pipeline to cli catalog

✨ Enhancement ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Add a new Tekton Pipeline definition for running Enterprise Contract verification.
• Parameterize policy, trust, and signature verification inputs for flexible cluster setups.
• Resolve tasks from the conforma/tekton-task bundle to enable catalog publishing.

Diagram

graph TD
  A(["PipelineRun"]) --> B["Pipeline: enterprise-contract"] --> C["Task: collect-keyless-params"] --> D["Task: verify-enterprise-contract"] --> E["Bundle: conforma/tekton-task"]
  D --> F{{"External services"}}
  subgraph Legend
    direction LR
    _run(["PipelineRun"]) ~~~ _pipe["Pipeline"] ~~~ _task["Task"] ~~~ _ext{{"External"}}
  end

Loading

High-Level Assessment

Keeping the pipeline definition co-located with other catalog artifacts (tasks/pipelines) is the most maintainable approach for publishing to conforma/tekton-catalog. Alternatives like generating the pipeline from templates or referencing an externally-owned pipeline would reduce duplication but add indirection and make local review/versioning harder.

Files changed (1) +156 / -0

Other (1) +156 / -0

enterprise-contract.yamlIntroduce enterprise-contract Tekton Pipeline definition (v0.1) +156/-0

Introduce enterprise-contract Tekton Pipeline definition (v0.1)

• Adds a new Tekton Pipeline that runs enterprise contract verification for snapshot component images. The pipeline collects keyless verification parameters first, then invokes verify-enterprise-contract with policy, trust, signature, and evaluation-time parameters and exposes TEST_OUTPUT as a pipeline result.

pipelines/enterprise-contract/0.1/enterprise-contract.yaml

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:09 PM UTC · Completed 1:27 PM UTC
Commit: 87c4a29 · View workflow run →

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d48ea95b-a094-481d-96c9-efe6ed7f1bc2

📥 Commits

Reviewing files that changed from the base of the PR and between eb985b2 and c1885c8.

📒 Files selected for processing (1)

• pipelines/enterprise-contract/0.1/enterprise-contract.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• pipelines/enterprise-contract/0.1/enterprise-contract.yaml

---

📝 Walkthrough

Walkthrough

Adds a Tekton enterprise-contract pipeline that collects keyless verification parameters, runs enterprise contract verification with configured inputs and a four-hour timeout, and exposes the verification test output.

Changes

Enterprise contract pipeline

Layer / File(s)	Summary
Pipeline contract and verification flow pipelines/enterprise-contract/0.1/enterprise-contract.yaml	Defines pipeline parameters and TEST_OUTPUT, then sequences keyless parameter collection before enterprise contract verification with forwarded inputs, collected credentials, Rekor bypass, and a four-hour timeout.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: simonbaird

Sequence Diagram(s)

sequenceDiagram
  participant Pipeline
  participant CollectKeylessParams
  participant VerifyEnterpriseContract
  Pipeline->>CollectKeylessParams: Collect keyless verification parameters
  CollectKeylessParams->>VerifyEnterpriseContract: Pass OIDC, identity, TUF, and Rekor values
  Pipeline->>VerifyEnterpriseContract: Pass verification parameters
  VerifyEnterpriseContract-->>Pipeline: Return TEST_OUTPUT

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title clearly summarizes the main change: adding the enterprise-contract pipeline definition.
Description check	✅ Passed	The description covers what changed, why it changed, and links the related ticket.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

⚠️ Tickets: not configured — ticket URL found in PR but could not be fetched — check ticket provider credentials

✅ Compliance rules (platform): 27 rules

1. Stale v2 task comment ✗ Dismissed 🐞 Bug ⚙ Maintainability

Description

The pipeline header comment says it runs verify-enterprise-contract-v2, but the Pipeline actually
resolves and runs verify-enterprise-contract, which can mislead maintainers and cause incorrect
updates/debugging.

Code

pipelines/enterprise-contract/0.1/enterprise-contract.yaml[R1-4]

+# The purpose of this pipeline is to execute the verify-enterprise-contract-v2 task for container
+# images that are built but not automatically released in order to provide early feedback to users.
+# When auto release is enabled, the task is executed by the release pipeline immediately after the
+# container images are built, thus it is not necessary to execute the task via this pipeline.

Relevance

⭐⭐ Medium

Trivial to fix, but repo history shows mixed appetite for comment-only “staleness” cleanup.

PR-#3357
PR-#2571

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new pipeline explicitly claims it runs the v2 task in its header, but the actual bundle-resolved
task name is verify-enterprise-contract, which matches the task defined in this repo.

pipelines/enterprise-contract/0.1/enterprise-contract.yaml[1-4]
pipelines/enterprise-contract/0.1/enterprise-contract.yaml[147-155]
tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml[18-22]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The pipeline header comment references `verify-enterprise-contract-v2`, but the pipeline taskRef resolves `verify-enterprise-contract`.

### Issue Context
This is a documentation mismatch that can confuse future maintenance (e.g., someone searching for “v2” or trying to bump the wrong task).

### Fix Focus Areas
- pipelines/enterprise-contract/0.1/enterprise-contract.yaml[1-4]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Misleading param descriptions ✗ Dismissed 🐞 Bug ⚙ Maintainability

Description

Pipeline param documentation diverges from the underlying verify-enterprise-contract task (e.g.,
POLICY_CONFIGURATION is described as an EnterpriseContractConfiguration object, while the task
describes an EnterpriseContractPolicy resource), increasing the risk of misconfiguration by pipeline
consumers.

Code

pipelines/enterprise-contract/0.1/enterprise-contract.yaml[R26-33]

+    - name: POLICY_CONFIGURATION
+      type: string
+      description: |
+        Name of the policy configuration (EnterpriseContractConfiguration
+        object) to use. `namespace/name` or `name` syntax supported. If
+        namespace is omitted the namespace where the task runs is used.
+      default: enterprise-contract-service/default
+    - name: SSL_CERT_DIR

Relevance

⭐⭐⭐ High

Repo has precedent for aligning Tekton param/docs text with actual behavior to reduce consumer
confusion.

PR-#3158

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The Pipeline describes POLICY_CONFIGURATION differently than the task’s own parameter documentation,
even though the pipeline passes the value straight through to the task; similarly, the Pipeline
describes SINGLE_COMPONENT_CUSTOM_RESOURCE as a PipelineRun ID while the task documents it as a
Kubernetes resource name including kind.

pipelines/enterprise-contract/0.1/enterprise-contract.yaml[26-33]
pipelines/enterprise-contract/0.1/enterprise-contract.yaml[70-73]
tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml[49-57]
tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml[198-210]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The Pipeline’s parameter descriptions are not consistent with the task it invokes, which can mislead users configuring the Pipeline.

### Issue Context
`POLICY_CONFIGURATION` is passed directly into the `verify-enterprise-contract` task, so the Pipeline should document the same semantics/value format as the task.

### Fix Focus Areas
- pipelines/enterprise-contract/0.1/enterprise-contract.yaml[26-33]
- pipelines/enterprise-contract/0.1/enterprise-contract.yaml[70-73]
- tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml[49-57]
- tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml[198-210]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Missing pipeline catalog metadata ✗ Dismissed 🐞 Bug ⚙ Maintainability

Description

The enterprise-contract Pipeline lacks the standard Tekton metadata used on tasks in this repo
(e.g., app.kubernetes.io/version and tekton.dev/displayName/tags/minVersion), reducing
discoverability and consistency for publishing/consuming it as a versioned catalog artifact.

Code

pipelines/enterprise-contract/0.1/enterprise-contract.yaml[R7-10]

+metadata:
+  name: enterprise-contract
+  labels:
+    build.appstudio.redhat.com/pipeline: "enterprise-contract"

Relevance

⭐⭐ Medium

No clear repo precedent for required Pipeline catalog annotations/labels; could be intentional
minimal metadata.

PR-#3153
PR-#3148

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new Pipeline metadata only includes a single label, while tasks in this repo consistently
include Tekton display/tags/minVersion annotations and an app version label, suggesting a repo
convention for catalog artifacts that the pipeline currently doesn’t follow.

pipelines/enterprise-contract/0.1/enterprise-contract.yaml[7-10]
tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml[20-28]
tasks/collect-keyless-params/0.1/collect-keyless-params.yaml[20-27]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The pipeline is stored under a versioned directory (`pipelines/.../0.1/`) but its `metadata` does not include the common catalog metadata (version label and Tekton display/tags/minVersion annotations) that the repo’s tasks include.

### Issue Context
Tasks in `tasks/*/0.1/*.yaml` consistently set these fields; adding the same style to the pipeline improves consistency and downstream catalog UX.

### Fix Focus Areas
- pipelines/enterprise-contract/0.1/enterprise-contract.yaml[7-10]
- tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml[20-28]
- tasks/collect-keyless-params/0.1/collect-keyless-params.yaml[20-27]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pipelines/enterprise-contract/0.1/enterprise-contract.yaml`:
- Around line 1-8: Add the repository-standard license header at the very
beginning of the enterprise-contract Pipeline YAML, before the existing purpose
comments and apiVersion declaration. Match the exact header convention used by
neighboring files under pipelines/ and tasks/.
- Around line 92-131: Update the verify task parameters to pass the
collect-keyless-params buildIdentityRegexp result as
CERTIFICATE_IDENTITY_REGEXP. Keep the existing CERTIFICATE_IDENTITY mapping to
tektonChainsIdentity unchanged, so verify receives both exact and regex-based
keyless identity configuration.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 288f9467-ccdf-4bb2-8b79-6ba6845ff769

📥 Commits

Reviewing files that changed from the base of the PR and between 4ea11df and eb985b2.

📒 Files selected for processing (1)

• pipelines/enterprise-contract/0.1/enterprise-contract.yaml

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.25% <ø> (-0.01%)	⬇️
generative	16.80% <ø> (ø)
integration	27.97% <ø> (ø)
unit	71.75% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Review

Findings

Medium

• [scope-gap] pipelines/enterprise-contract/0.1/enterprise-contract.yaml — The PR introduces a new pipelines/ top-level directory but does not update the supporting infrastructure: (1) Makefile tekton-lint target only globs tasks/*/*/*.yaml, (2) release workflow only publishes task bundles from tasks/, (3) no artifacthub-repo.yml added under pipelines/. The PR description states the goal is "publishing to conforma/tekton-catalog alongside existing tasks," but this change alone does not achieve publishing.
  Remediation: Either expand the PR scope to include linting/publishing/artifacthub support for pipelines/, or explicitly document these as follow-up work items.

• [license-header-format] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:1 — Missing YAML document start marker ---. All three existing task YAML files in the repo begin with --- on line 1, followed by the license comment block.
  Remediation: Add --- as the first line of the file, before the # Copyright comment.

• [metadata-labels] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:25 — Missing app.kubernetes.io/version label. All three existing task definitions include app.kubernetes.io/version: "0.1" in their metadata.labels.
  Remediation: Add app.kubernetes.io/version: "0.1" to metadata.labels.

Low

• [technical-accuracy] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:17 — The header comment states this pipeline executes "the verify-enterprise-contract-v2 task," but the actual taskRef references verify-enterprise-contract (no -v2 suffix). No task named verify-enterprise-contract-v2 exists in the repository.
  Remediation: Change the comment to say "verify-enterprise-contract task."

• [architectural-coherence] pipelines/enterprise-contract/0.1/enterprise-contract.yaml — The pipeline references tasks via quay.io/conforma/tekton-task:konflux bundle resolver using a floating tag. This is consistent with the existing codebase pattern but means pipeline correctness depends on the bundle publish pipeline succeeding first.

• [metadata-annotations] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:23 — Missing metadata.annotations block. Existing task definitions include annotations such as tekton.dev/displayName, though not all task annotations are directly applicable to a Pipeline resource.

• [missing-docs] internal/documentation/asciidoc/tekton/tekton.go:56 — The documentation generation tooling only globs tasks/*/*/*.yaml and unmarshals into Task structs. The new pipeline will not be auto-documented; extending support would require Pipeline-specific parsing beyond just adding a glob pattern.

• [missing-docs] docs/modules/ROOT/pages/tasks.adoc:1 — The Tekton resources landing page only mentions tasks. With the addition of a Pipeline resource, this could be updated in a follow-up.

• [missing-docs] docs/modules/ROOT/partials/tasks_nav.adoc:1 — The navigation partial only lists tasks. The new pipeline will not appear in the documentation navigation.

• [missing-docs] docs/modules/ROOT/pages/index.adoc:14 — The documentation index page mentions the Verify Enterprise Contract Task but does not mention the new Pipeline resource.

Previous run

Review

Findings

High

• [scope-coherence] Makefile:250 — The tekton-lint target only globs tasks/*/*/*.yaml. The new pipelines/ directory will not be linted by CI. The .tektonlintrc.yaml already has pipeline-specific rules enabled (no-pipeline-missing-parameters, no-pipeline-missing-task, no-pipeline-task-cycle) but they will never fire on pipeline definitions outside the tasks/ glob. This means the new pipeline YAML will ship without the same lint guarantees that tasks have.
  Remediation: Extend the tekton-lint Makefile target to also glob pipelines/*/*/*.yaml.

Low

• [stale-reference] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:18 — The comment states "execute the verify-enterprise-contract-v2 task" but the pipeline's taskRef references verify-enterprise-contract (without -v2). No task named verify-enterprise-contract-v2 exists in the repository.
  Remediation: Change the comment to reference verify-enterprise-contract.

• [api-contract] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:44 — The POLICY_CONFIGURATION description refers to "EnterpriseContractConfiguration object" but the correct type name is EnterpriseContractPolicy, used consistently throughout the codebase and in the downstream task's own description.
  Remediation: Change EnterpriseContractConfiguration to EnterpriseContractPolicy.

• [document-format] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:1 — Missing YAML document separator (---) at the top of the file. All existing Tekton resource files in tasks/ start with --- before the copyright header.
  Remediation: Add --- as the first line of the file.

• [metadata-consistency] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:25 — The pipeline metadata lacks annotations (tekton.dev/displayName, tekton.dev/pipelines.minVersion, tekton.dev/tags) and the app.kubernetes.io/version label that all task definitions in this repo include.

• [architecture-documentation] AGENTS.md — AGENTS.md documents the project structure and mentions tekton-lint for tasks but does not mention the new pipelines/ directory.

---

Labels: PR adds a Tekton Pipeline definition for CI verification workflows

Previous run (2)

Review

Findings

Medium

• [license-header] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:1 — The new pipeline file is missing the standard Apache-2.0 license header. Every existing YAML definition in tasks/ starts with the Copyright The Conforma Contributors / Apache-2.0 / SPDX-License-Identifier block. The Makefile's addlicense check covers all tracked files and pipelines/ is not in the ignore list, so CI will flag this.
  Remediation: Add the standard Apache-2.0 license header at the top of the file, before the purpose comment, matching the format in tasks/*.yaml.

• [incomplete-integration] pipelines/enterprise-contract/0.1/enterprise-contract.yaml — The Makefile's tekton-lint target only globs tasks/*/*/*.yaml. The new pipelines/ directory follows the same versioned path convention but is not picked up by tekton-lint, creating a gap in CI validation coverage.
  Remediation: Update the Makefile tekton-lint target to also glob pipelines/*/*/*.yaml, or raise this as a follow-up issue.

Low

• [stale-reference] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:1 — The header comment says "verify-enterprise-contract-v2 task" but the actual task referenced is verify-enterprise-contract (no v2 suffix). No v2 variant exists in the repository.
  Remediation: Change the comment to say "verify-enterprise-contract task".

• [api-contract] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:30 — The POLICY_CONFIGURATION description refers to "EnterpriseContractConfiguration object", but the underlying task uses "EnterpriseContractPolicy resource".
  Remediation: Align the description with the task's terminology.

• [api-contract] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:12 — The pipeline does not expose SINGLE_COMPONENT_CUSTOM_RESOURCE_NS. When SINGLE_COMPONENT=true, the task uses its default (empty string). Not a functional failure, but an incomplete interface for the single-component flow.
  Remediation: Add the parameter for completeness, or document the reliance on the task's default.

• [metadata-annotations] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:7 — Missing tekton.dev/displayName, tekton.dev/pipelines.minVersion, and tekton.dev/tags annotations present on all existing task definitions.
  Remediation: Add annotations matching the pattern in tasks/*.yaml.

• [metadata-labels] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:9 — Missing app.kubernetes.io/version: "0.1" label included on all existing task definitions.
  Remediation: Add app.kubernetes.io/version: "0.1" to the labels block.

• [pattern-inconsistency] pipelines/enterprise-contract/0.1/enterprise-contract.yaml:31 — POLICY_CONFIGURATION default is unquoted; the existing convention quotes string defaults.
  Remediation: Change to default: "enterprise-contract-service/default".

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:31 PM UTC · Completed 1:48 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:30 AM UTC · Completed 8:48 AM UTC
Commit: 87c4a29 · View workflow run →

Superseded by updated review

[fullsend-ai-review]

See the review comment for full details.