chore: New Task to allow for centralisation of release-version tags

konflux-configs/base/config/kustomization.yaml

@@ -9,3 +9,9 @@ configMapGenerator:
     literals:
       - automerge="true"
       - platformAutomerge="true"
+
+  # Release version mappings for repo+branch
+  # Versions are defined in rhtas-versions.properties
+  - name: rhtas-repo-branch-versions
+    envs:
+      - rhtas-versions.properties

konflux-configs/base/config/rhtas-versions.properties

@@ -0,0 +1,144 @@
+# RHTAS Release Version Mappings
+# Format: <repo-name>__<branch-name>=<version>
+# Double underscore (__) separates repo from branch
+
+# ============================================================================
+# RHTAS OPERATOR CORE COMPONENTS
+# These components are deployed and managed by the RHTAS operator
+# ============================================================================
+
+
+# === Fulcio ===
+fulcio__main=1.5.0
+fulcio__release-1.4=1.4.2
+fulcio__release-1.3=1.3.5
+
+# === Rekor ===
+rekor__main=1.5.0
+rekor__release-1.4=1.4.2
+rekor__release-1.3=1.3.5
+
+# === Timestamp Server ===
+timestamp-authority__main=1.5.0
+timestamp-authority__release-1.4=1.4.2
+timestamp-authority__release-1.3=1.3.5
+
+# === TUF Server ===
+tuf-server__main=1.5.0
+tuf-server__release-1.4=1.4.2
+tuf-server__release-1.3=1.3.5
+
+# === Trillian ===
+trillian__main=1.5.0
+trillian__release-1.4=1.4.2
+trillian__release-1.3=1.3.5
+
+# === RHTAS Operator (the operator itself) ===
+secure-sign-operator__main=1.5.0
+secure-sign-operator__release-1.4=1.4.2
+secure-sign-operator__release-1.3=1.3.5
+
+# === RHTAS Console ===
+rhtas-console__main=1.5.0
+rhtas-console__release-1.4=1.4.2
+rhtas-console__release-1.3=1.3.5
+
+# === RHTAS Console UI ===
+rhtas-console-ui__main=1.5.0
+rhtas-console-ui__release-1.4=1.4.2
+rhtas-console-ui__release-1.3=1.3.5
+
+# === Cosign ===
+cosign__main=1.5.0
+cosign__release-1.4=1.4.2
+cosign__release-1.3=1.3.5
+
+# === Gitsign ===
+gitsign__main=1.5.0
+gitsign__release-1.4=1.4.2
+gitsign__release-1.3=1.3.5
+
+# === Certificate Transparency Go ===
+certificate-transparency-go__main=1.5.0
+certificate-transparency-go__release-1.4=1.4.2
+certificate-transparency-go__release-1.3=1.3.5
+
+# === Model Transparency Go ===
+model-transparency-go__main=1.5.0
+model-transparency-go__release-1.4=1.4.2
+model-transparency-go__release-1.3=1.3.5
+
+# === Rekor Search UI ===
+rekor-search-ui__main=1.5.0
+rekor-search-ui__release-1.4=1.4.2
+rekor-search-ui__release-1.3=1.3.5
+# ============================================================================
+# AUXILIARY COMPONENTS
+# Supporting tools and utilities
+# ============================================================================
+
+# === Artifact Signer Ansible ===
+artifact-signer-ansible__main=1.5.0
+artifact-signer-ansible__release-1.4=1.4.2
+artifact-signer-ansible__release-1.3=1.3.5
+
+# === Model Transparency ===
+model-transparency__main=0.1.0
+
+# === Model Validation Operator ===
+model-validation-operator__main=0.1.0
+
+# === Tough ===
+tough__develop=1.5.0
+tough__release-1.4=1.4.2
+tough__release-1.3=1.3.5
+
+# === Rekor Monitor ===
+rekor-monitor__main=1.5.0-dev
+rekor-monitor__release-1.4=1.4.2
+rekor-monitor__release-1.3=1.3.5
+
+# === Segment Backup Job ===
+segment-backup-job__main=1.5.0-dev
+segment-backup-job__release-1.4=1.4.2
+segment-backup-job__release-1.3=1.3.5
+
+# ============================================================================
+# POLICY CONTROLLER COMPONENTS
+# Separate release cycle from main RHTAS components
+# ============================================================================
+
+# === Policy Controller ===
+policy-controller__main=1.5.0
+policy-controller__release-1.0=1.4.2
+
+# === Policy Controller Operator ===
+policy-controller-operator__main=1.5.0
+policy-controller-operator__release-1.0=1.4.2
+
+# ============================================================================
+# REPO-ONLY FALLBACKS
+# Used when exact repo__branch combination is not found
+# ============================================================================
+
+artifact-signer-ansible=1.5.0-dev
+certificate-transparency-go=1.5.0-dev
+cosign=1.5.0-dev
+fulcio=1.5.0-dev
+gitsign=1.5.0-dev
+model-transparency=1.5.0-dev
+model-transparency-go=1.5.0-dev
+model-validation-operator=1.5.0-dev
+policy-controller=1.5.0-dev
+policy-controller-operator=1.5.0-dev
+rekor=1.5.0-dev
+rekor-monitor=1.5.0-dev
+rekor-search-ui=1.5.0-dev
+rhtas-console=1.5.0-dev
+rhtas-console-ui=1.5.0-dev
+secure-sign-operator=1.5.0-dev
+segment-backup-job=1.5.0-dev
+timestamp-authority=1.5.0-dev
+tough=1.5.0-dev
+trillian=1.5.0-dev
+tuf-server=1.5.0-dev

pipelines/bundle-build-oci-ta.yaml

@@ -184,6 +184,27 @@ spec:
       workspace: git-auth
     - name: netrc
       workspace: netrc
+  - name: get-version-from-configmap
+    taskRef:
+      resolver: git
+      params:
+      - name: url
+        value: "https://github.com/securesign/pipelines.git"
+      - name: revision
+        value: "main"
+      - name: pathInRepo
+        value: tasks/get-version-from-configmap.yaml
+    params:
+    - name: git-url
+      value: $(params.git-url)
+    - name: revision
+      value: $(params.revision)
+    - name: configmap-name
+      value: rhtas-repo-branch-versions
+    - name: configmap-namespace
+      value: rhtas-tenant
+    - name: default-version
+      value: $(params.release-version)
   - name: derive-product-version
     taskRef:
       resolver: git
@@ -196,9 +217,11 @@ spec:
         value: tasks/derive-product-version.yaml
     params:
     - name: release-version
-      value: $(params.release-version)
+      value: $(tasks.get-version-from-configmap.results.release-version)
     - name: image-version
       value: $(params.image-version)
+    runAfter:
+    - get-version-from-configmap
   - name: generate-labels
     params:
     - name: label-templates

pipelines/docker-build-multi-platform-oci-ta.yaml

@@ -202,6 +202,27 @@ spec:
       workspace: git-auth
     - name: netrc
       workspace: netrc
+  - name: get-version-from-configmap
+    taskRef:
+      resolver: git
+      params:
+      - name: url
+        value: "https://github.com/securesign/pipelines.git"
+      - name: revision
+        value: "main"
+      - name: pathInRepo
+        value: tasks/get-version-from-configmap.yaml
+    params:
+    - name: git-url
+      value: $(params.git-url)
+    - name: revision
+      value: $(params.revision)
+    - name: configmap-name
+      value: rhtas-repo-branch-versions
+    - name: configmap-namespace
+      value: rhtas-tenant
+    - name: default-version
+      value: $(params.release-version)
   - name: derive-product-version
     taskRef:
       resolver: git
@@ -214,9 +235,11 @@ spec:
         value: tasks/derive-product-version.yaml
     params:
     - name: release-version
-      value: $(params.release-version)
+      value: $(tasks.get-version-from-configmap.results.release-version)
     - name: image-version
       value: $(params.image-version)
+    runAfter:
+    - get-version-from-configmap
   - name: generate-labels
     params:
     - name: label-templates

pipelines/docker-build-oci-ta.yaml

@@ -185,6 +185,27 @@ spec:
       workspace: git-auth
     - name: netrc
       workspace: netrc
+  - name: get-version-from-configmap
+    taskRef:
+      resolver: git
+      params:
+      - name: url
+        value: "https://github.com/securesign/pipelines.git"
+      - name: revision
+        value: "main"
+      - name: pathInRepo
+        value: tasks/get-version-from-configmap.yaml
+    params:
+    - name: git-url
+      value: $(params.git-url)
+    - name: revision
+      value: $(params.revision)
+    - name: configmap-name
+      value: rhtas-repo-branch-versions
+    - name: configmap-namespace
+      value: rhtas-tenant
+    - name: default-version
+      value: $(params.release-version)
   - name: derive-product-version
     taskRef:
       resolver: git
@@ -197,9 +218,11 @@ spec:
         value: tasks/derive-product-version.yaml
     params:
     - name: release-version
-      value: $(params.release-version)
+      value: $(tasks.get-version-from-configmap.results.release-version)
     - name: image-version
       value: $(params.image-version)
+    runAfter:
+    - get-version-from-configmap
   - name: generate-labels
     params:
     - name: label-templates

pipelines/docker-build.yaml

@@ -200,6 +200,27 @@ spec:
       workspace: git-auth
     - name: netrc
       workspace: netrc
+  - name: get-version-from-configmap
+    taskRef:
+      resolver: git
+      params:
+      - name: url
+        value: "https://github.com/securesign/pipelines.git"
+      - name: revision
+        value: "main"
+      - name: pathInRepo
+        value: tasks/get-version-from-configmap.yaml
+    params:
+    - name: git-url
+      value: $(params.git-url)
+    - name: revision
+      value: $(params.revision)
+    - name: configmap-name
+      value: rhtas-repo-branch-versions
+    - name: configmap-namespace
+      value: rhtas-tenant
+    - name: default-version
+      value: $(params.release-version)
   - name: derive-product-version
     taskRef:
       resolver: git
@@ -212,9 +233,11 @@ spec:
         value: tasks/derive-product-version.yaml
     params:
     - name: release-version
-      value: $(params.release-version)
+      value: $(tasks.get-version-from-configmap.results.release-version)
     - name: image-version
       value: $(params.image-version)
+    runAfter:
+    - get-version-from-configmap
   - name: generate-labels
     params:
     - name: label-templates