HYPERFLEET-1819 - ci: validation run for the secret-scan workflow (do not merge)

.github/workflows/secret-scan.yml

@@ -0,0 +1,129 @@
+# Secret scanning for clean CI checkouts.
+#
+# The leaktk.git.pre-commit hook only scans staged changes and ignores the
+# filenames passed by pre-commit, so it is a no-op on a clean CI checkout:
+# a green "pre-commit run --all-files" is not evidence that PR content was
+# scanned. This job closes that gap.
+#
+# Scope: the working tree of the fresh pull_request checkout, which is the
+# tracked content at the merge HEAD. It is not a scan of git history and it
+# does not depend on the index being populated.
+#
+# Behavior: fail-closed. Findings, scanner errors, missing, invalid or
+# non-correlated responses and timeouts all fail the job. Scanner stdout and
+# stderr are captured and never printed; findings are reported with rule,
+# path and line only.
+#
+# The LeakTK revision is the one pinned by this repository in
+# .pre-commit-config.yaml (full commit SHA required; tag-only pins are
+# rejected). This is a secondary, non-required gate.
+name: secret-scan
+
+on:
+  pull_request:
+
+permissions: {}
+
+concurrency:
+  group: secret-scan-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  secret-scan:
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      CGO_ENABLED: "0"
+      LEAKTK_ID: ci-secret-scan
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: false
+
+      - name: Resolve the pinned LeakTK revision
+        run: |
+          set -euo pipefail
+          LEAKTK_REV=$(awk '
+            /^[[:space:]]*-[[:space:]]*repo:[[:space:]]*https:\/\/github\.com\/leaktk\/leaktk[[:space:]]*$/ { in_repo = 1; next }
+            in_repo && /^[[:space:]]*rev:/ { print $2; exit }
+            in_repo && /^[[:space:]]*-[[:space:]]*repo:/ { in_repo = 0 }
+          ' .pre-commit-config.yaml | tr -d '"')
+          if [ -z "${LEAKTK_REV:-}" ]; then
+            echo "::error::No leaktk rev found in .pre-commit-config.yaml. Adopting the secret scan in a repository without LeakTK requires an explicit scope decision; refusing to scan silently."
+            exit 1
+          fi
+          if ! printf '%s' "$LEAKTK_REV" | grep -qE '^[0-9a-f]{40}$'; then
+            echo "::error::The leaktk rev in .pre-commit-config.yaml must be a full 40-character commit SHA; got: ${LEAKTK_REV}. Tag-only pins are rejected."
+            exit 1
+          fi
+          echo "LeakTK revision from .pre-commit-config.yaml: ${LEAKTK_REV}"
+          echo "LEAKTK_REV=${LEAKTK_REV}" >> "$GITHUB_ENV"
+
+      - name: Install LeakTK at the pinned revision
+        run: |
+          set -euo pipefail
+          LEAKTK_BIN="$RUNNER_TEMP/leaktk-bin/leaktk"
+          mkdir -p "$(dirname "$LEAKTK_BIN")"
+          GOBIN="$(dirname "$LEAKTK_BIN")" go install github.com/leaktk/leaktk@"$LEAKTK_REV"
+          "$LEAKTK_BIN" version || true
+
+      - name: Scan tracked content for secrets
+        run: |
+          set -euo pipefail
+          LEAKTK_BIN="$RUNNER_TEMP/leaktk-bin/leaktk"
+
+          HEAD_SHA=$(git rev-parse HEAD)
+          TRACKED_FILES=$(git ls-files | wc -l | tr -d ' ')
+          RESPONSE_FILE="$RUNNER_TEMP/leaktk-response.json"
+          STDERR_FILE="$RUNNER_TEMP/leaktk-stderr.log"
+
+          set +e
+          timeout 480 "$LEAKTK_BIN" scan \
+            --kind Files \
+            --leak-exit-code 1 \
+            --format json \
+            --id "$LEAKTK_ID" \
+            . >"$RESPONSE_FILE" 2>"$STDERR_FILE"
+          SCAN_STATUS=$?
+          set -e
+
+          # Fail closed unless the scanner returns a valid response for this request.
+          if ! jq -e --arg id "$LEAKTK_ID" '.kind == "ScanResults" and .request_id == $id' "$RESPONSE_FILE" >/dev/null 2>&1; then
+            echo "::error::LeakTK did not return a valid response for this scan (exit status: ${SCAN_STATUS}); failing closed. Raw scanner output is withheld."
+            exit 1
+          fi
+
+          if jq -e '.error != null' "$RESPONSE_FILE" >/dev/null; then
+            echo "::error::LeakTK scan failed: $(jq -r '.error.message' "$RESPONSE_FILE") (code $(jq -r '.error.code' "$RESPONSE_FILE"))"
+            exit 1
+          fi
+
+          if ! jq -e '(.results | type) == "array"' "$RESPONSE_FILE" >/dev/null; then
+            echo "::error::LeakTK response has no results array; failing closed."
+            exit 1
+          fi
+
+          FINDINGS=$(jq '.results | length' "$RESPONSE_FILE")
+
+          if [ "$FINDINGS" -gt 0 ]; then
+            echo "::error::Secret scan found ${FINDINGS} potential secret(s) in the tracked content at HEAD ${HEAD_SHA}."
+            echo "Redacted findings (secret values are withheld):"
+            jq -r '.results[] | "- \(.rule.description) at \(.location.path):\(.location.start.line) (rule id: \(.rule.id))"' "$RESPONSE_FILE"
+            exit 1
+          fi
+
+          if [ "$SCAN_STATUS" -ne 0 ]; then
+            echo "::error::LeakTK exited with status ${SCAN_STATUS} without reporting findings or errors; failing closed."
+            exit 1
+          fi
+
+          echo "Secret scan clean: ${TRACKED_FILES} tracked files at HEAD ${HEAD_SHA} scanned with LeakTK ${LEAKTK_REV} (kind=Files on the fresh checkout)."

.pre-commit-config.yaml

@@ -3,13 +3,13 @@ default_install_hook_types: [pre-commit, commit-msg]
 repos:
   # Secret scanning (VPN-free, open-source alternative to rh-pre-commit)
   - repo: https://github.com/leaktk/leaktk
-    rev: e62a495260dc1e396fa586e51bbe1355f6fc7d9d # v0.3.3
+    rev: c6f5a11329736a8dc1551a84603f117bd9ed498e  # frozen: v0.3.12
     hooks:
       - id: leaktk.git.pre-commit
 
   # HyperFleet code quality hooks
   - repo: https://github.com/openshift-hyperfleet/hyperfleet-hooks
-    rev: 7f5119208e5cdee3f0c688881b6a4b803095f203 # v0.2.1
+    rev: d9aab6d723c9246bd2f63a982bf1d9cf0805b3a4  # frozen: v0.3.0
     hooks:
       - id: hyperfleet-commitlint
         stages: [commit-msg]
@@ -19,8 +19,9 @@ repos:
 
   # File hygiene
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0 # v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
     hooks:
       - id: trailing-whitespace
+        args: [--markdown-linebreak-ext=md]
       - id: end-of-file-fixer
       - id: check-added-large-files

.tekton/OWNERS

@@ -0,0 +1,7 @@
+approvers:
+- release-owners
+reviewers:
+- release-reviewers
+- release-owners
+labels:
+- area/release

.tekton/README.md

@@ -0,0 +1,52 @@
+# Konflux build failure alerts
+
+The four PipelineRuns in this directory build the API image and chart:
+
+| PipelineRun | Trigger |
+| --- | --- |
+| `hyperfleet-api-on-push` | Push to `main` |
+| `hyperfleet-api-on-tag` | Version tag |
+| `hyperfleet-api-chart-on-push` | Chart push |
+| `hyperfleet-api-chart-on-tag` | Chart tag |
+
+Each inline `pipelineSpec` has a `slack-webhook-notification` task in `finally`.
+It runs only when `$(tasks.status)` is `Failed`. The Slack message links the
+repository, commit, and failed PipelineRun with readable text. A successful
+PipelineRun skips this task. A failure before a PipelineRun starts, including a
+Pipelines as Code admission failure, cannot trigger it.
+
+The task reads key `hyperfleet-slack-webhook-url` from Secret
+`hyperfleet-slack-webhook-notification-secret` in `hyperfleet-tenant` on
+`kflux-prd-rh02`. The webhook value must never be committed or printed in logs.
+The Secret must be available to the build task Pod. HyperFleet manages this
+Secret in its own tenant namespace. The webhook determines the Slack channel.
+The existing release notification uses a separate Secret in
+`rhtap-releng-tenant`, managed by RelEng.
+
+## Check a missing alert
+
+Open the failed PipelineRun in the [Konflux UI](https://konflux-ui.apps.kflux-prd-rh02.0fk9.p1.openshiftapps.com/)
+and inspect its `slack-webhook-notification` final task. Check whether it was
+scheduled, whether the Secret and key were mounted, and whether the Slack POST
+succeeded. If no PipelineRun exists, inspect the Pipelines as Code check on the
+GitHub commit. A successful run should show the final task skipped and produce
+no build failure alert.
+
+## Rotate the webhook
+
+1. Obtain a replacement incoming webhook for the agreed team channel through
+   the HyperFleet team. Confirm whether the URL is shared with release
+   notifications.
+2. Update `hyperfleet-tenant/hyperfleet-slack-webhook-notification-secret`, key
+   `hyperfleet-slack-webhook-url`, through the team's Secret management process.
+   Update its configuration source if one is used. If the URL is shared,
+   coordinate the release namespace Secret update with RelEng.
+3. With approval for a controlled Konflux run and Slack post, trigger a failed
+   PipelineRun and confirm the alert fields, link, and delivery time. Check a
+   successful run emits no build failure alert. If sharing the URL, confirm a
+   release notification still arrives.
+4. Revoke the old webhook only after every consumer has been verified on the
+   replacement URL.
+
+See the [HyperFleet notification runbook](https://github.com/openshift-hyperfleet/architecture/blob/main/hyperfleet/docs/release/operations/notifications.md)
+for build and release notification ownership and troubleshooting.

.tekton/hyperfleet-api-chart-push.yaml

@@ -97,7 +97,7 @@ spec:
         - name: name
           value: init
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:4be9343579d91c7b501cafe966cff59a601dfeca903c476e3763dd8d7599b900
+          value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:5197c2d81b0d0babe7468e8c06a9281fdf0654bba369faca4492233dc88f54e4
         - name: kind
           value: task
         resolver: bundles
@@ -118,7 +118,7 @@ spec:
         - name: name
           value: git-clone-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:2e8fe30b6d5c8a8a3e6bbc0ea5a55e05b6170d4a399830f25ea43e17881ce544
+          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:a3678910c2bf9187a66a96066193cb41046fbb7097160bf2be6a374ed5e49d30
         - name: kind
           value: task
         resolver: bundles
@@ -144,7 +144,7 @@ spec:
         - name: name
           value: prefetch-dependencies-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.10.2@sha256:374f776bcb2048c3adeaf4dbb460c52d001bc6020320df5e878c2d05391302da
+          value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.11.0@sha256:7ffdaab6322c4bed64297eb79f767d92609a3e24bd123b14dc73536c038bf5b7
         - name: kind
           value: task
         resolver: bundles
@@ -170,7 +170,7 @@ spec:
         - name: name
           value: build-helm-chart-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-build-helm-chart-oci-ta:0.3@sha256:cc59ae16baa756d23f3e5f8328cd9f8ba39a388f8eafbb9db666dea694814d25
+          value: quay.io/konflux-ci/tekton-catalog/task-build-helm-chart-oci-ta:0.4@sha256:60153fca674adf0be0e7e2c358403ece505738cbe29a5ca3ea518977fab6d6cf
         - name: kind
           value: task
         resolver: bundles
@@ -182,8 +182,6 @@ spec:
         value: $(tasks.build-helm-chart.results.IMAGE_URL)
       - name: SOURCE_ARTIFACT
         value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
       - name: TARGET_DIRS
         value: $(params.sast-target-dirs)
       runAfter:
@@ -193,7 +191,7 @@ spec:
         - name: name
           value: sast-shell-check-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:afa8ba8859739e48b672f66fa2af357d27f4d96846a7c0ad84e38f21b043f695
+          value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1.1@sha256:83722286ec3297e3f66b0c220cec8895e0f745337e464c1d1c038ed737cf69fd
         - name: kind
           value: task
         resolver: bundles
@@ -210,8 +208,6 @@ spec:
         value: $(tasks.build-helm-chart.results.IMAGE_URL)
       - name: SOURCE_ARTIFACT
         value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
       - name: TARGET_DIRS
         value: $(params.sast-target-dirs)
       runAfter:
@@ -221,7 +217,7 @@ spec:
         - name: name
           value: sast-unicode-check-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:69d5fca2fb94dcc7df32e36e4828e6fb24b9ba55b1837c331a83e20d8dfd479e
+          value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4.1@sha256:2ee89730856f542d851d99b5d945963583a840c295354dc4257a0052841e35ab
         - name: kind
           value: task
         resolver: bundles
@@ -230,6 +226,33 @@ spec:
         operator: in
         values:
         - "false"
+    finally:
+    - name: slack-webhook-notification
+      params:
+      - name: message
+        value: |
+          :rotating_light: *Konflux build failed*
+          *Repository:* <$(params.git-url)|hyperfleet-api>
+          *Pipeline:* `hyperfleet-api-chart-on-push`
+          *Commit:* <https://github.com/openshift-hyperfleet/hyperfleet-api/commit/$(params.revision)|$(params.revision)>
+          *Failed run:* <https://konflux-ui.apps.kflux-prd-rh02.0fk9.p1.openshiftapps.com/ns/$(context.pipelineRun.namespace)/pipelinerun/$(context.pipelineRun.name)|Open in Konflux>
+      - name: secret-name
+        value: hyperfleet-slack-webhook-notification-secret
+      - name: key-name
+        value: hyperfleet-slack-webhook-url
+      taskRef:
+        resolver: bundles
+        params:
+        - name: bundle
+          value: quay.io/konflux-ci/tekton-catalog/task-slack-webhook-notification:0.1@sha256:55fdfbe3b4a565aa58fc76d6209a3b69832f43373ee6e33555bb69423a8b9ceb
+        - name: name
+          value: slack-webhook-notification
+        - name: kind
+          value: Task
+      when:
+      - input: $(tasks.status)
+        operator: in
+        values: ["Failed"]
     workspaces:
     - name: git-auth
       optional: true