build: enable hermetic builds for cosign cli-stack

[sampras343]

Summary

• Enable hermetic builds for the cosign-cli-stack component (both push and pull-request pipelines)
• Add prefetch-input with gomod cachi2 prefetch to both pipelines
• conforma-cli-stack already has hermetic enabled, no changes needed there

Test plan

• Verify the cosign cli-stack PR build passes with hermetic enabled

[qodo-for-securesign]

PR Summary by Qodo

build: enable hermetic builds for cosign cli-stack Tekton pipelines

⚙️ Configuration changes ✨ Enhancement 🕐 10-20 Minutes

AI Description

• Enable hermetic builds for cosign-cli-stack in push and pull-request pipelines.
• Add gomod cachi2 prefetch-input to ensure dependencies are available offline.
• Keep existing build behavior otherwise unchanged (still builds source image).

Diagram

graph TD
  A["Git repo (cosign-cli-stack)"] --> B["Tekton PipelineRun"] --> C["prefetch-input (gomod)"] --> D["cachi2 prefetch"] --> E["hermetic build"] --> F["built source image"]
  F --> G["image registry"]

  subgraph Legend
    direction LR
    _src["Source"] ~~~ _pipe["Pipeline"] ~~~ _step["Build step"]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Set hermetic/prefetch defaults in the referenced Pipeline

• ➕ Avoids duplicating param wiring across multiple PipelineRuns (push/PR)
• ➕ Reduces risk of drift between event pipelines
• ➖ May affect other consumers of the same Pipeline definition
• ➖ Requires coordination and potentially broader testing/rollout

2. Use a shared Tekton snippet/template for common params

• ➕ Keeps event-specific YAML minimal while preventing configuration drift
• ➕ Scales better as more stacks/pipelines adopt hermetic builds
• ➖ Requires introducing/maintaining templating (e.g., Kustomize/Helm/jsonnet)
• ➖ Adds a layer of indirection for reviewers/operators

Recommendation: The PR’s approach is appropriate for a targeted enablement: flipping the PipelineRun params and adding prefetch-input is low-risk and easy to roll back. If more stacks adopt hermetic builds, consider moving these params into the shared Pipeline defaults (or a common template) to prevent push/PR drift.

Files changed (2) +6 / -2

Other (2) +6 / -2

cosign-cli-stack-pull-request.yamlEnable hermetic mode and add gomod prefetch for PR builds +3/-1

Enable hermetic mode and add gomod prefetch for PR builds

• Adds the 'prefetch-input' parameter configured for Go modules and enables 'hermetic: true' for the cosign cli-stack pull-request PipelineRun.

.tekton/cosign-cli-stack-pull-request.yaml

cosign-cli-stack-push.yamlEnable hermetic mode and add gomod prefetch for push builds +3/-1

Enable hermetic mode and add gomod prefetch for push builds

• Adds the 'prefetch-input' parameter configured for Go modules and enables 'hermetic: true' for the cosign cli-stack push PipelineRun.

.tekton/cosign-cli-stack-push.yaml

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}