ROX-34386: Backport changes from release branch

.tekton/acs-mcp-server-pull-request.yaml

@@ -18,8 +18,8 @@ metadata:
           target_branch == "main" ||
           target_branch.startsWith("release-") ||
           (
-            has(body.pull_request) && 
-            has(body.pull_request.labels) && 
+            has(body.pull_request) &&
+            has(body.pull_request.labels) &&
             body.pull_request.labels.exists(l, l.name == "konflux-build")
           )
         )
@@ -39,7 +39,7 @@ spec:
   - name: output-image-repo
     value: quay.io/redhat-user-workloads/agentic-cluster-security-suite-tenant/acs-mcp-server
   - name: image-expires-after
-    value: 5d
+    value: "5d"
   - name: dockerfile
     value: konflux.Dockerfile
   - name: hermetic
@@ -54,6 +54,10 @@ spec:
     value: '0'
   - name: clone-fetch-tags
     value: 'true'
+  - name: extra-labels
+    value:
+    # X.Y in the cpe label must be adjusted for every version stream.
+    - "cpe=cpe:/a:redhat:agentic_cluster_security_suite:X.Y::el9"
 
   pipelineRef:
     name: basic-component-pipeline

.tekton/acs-mcp-server-push.yaml → .tekton/acs-mcp-server-push-main.yaml

@@ -9,30 +9,27 @@ metadata:
     pipelinesascode.tekton.dev/max-keep-runs: "10"
     pipelinesascode.tekton.dev/on-label: "[]"
     # For push trigger:
-    # - trigger on commit push on main or release branch.
-    # - trigger on tag pushes.
+    # - trigger on commit push on main.
     # For PR triggers:
     # - body.action != "ready_for_review" prevents double-triggering when a draft PR is marked ready for review.
-    # - trigger only for PRs on release branches.
-    # - support triggering by label: "konflux-build"
+    # - trigger only for PRs on main branch with label: "konflux-build"
     pipelinesascode.tekton.dev/on-cel-expression: |
       (
-        event == "push" && target_branch.matches("^(main|release-.*|refs/tags/.*)$")
+        event == "push" &&
+        target_branch.matches("^main$")
       ) || (
-        event == "pull_request" && body.action != "ready_for_review" && (
-          target_branch.startsWith("release-") ||
-          (
-            has(body.pull_request) && 
-            has(body.pull_request.labels) && 
-            body.pull_request.labels.exists(l, l.name == "konflux-build")
-          )
-        )
+        event == "pull_request" &&
+        target_branch.matches("^main$") &&
+        body.action != "ready_for_review" &&
+        has(body.pull_request) &&
+        has(body.pull_request.labels) &&
+        body.pull_request.labels.exists(l, l.name == "konflux-build")
       )
   labels:
     appstudio.openshift.io/application: agentic-cluster-security-suite
     appstudio.openshift.io/component: acs-mcp-server
     pipelines.appstudio.openshift.io/type: build
-  name: acs-mcp-server-on-push
+  name: acs-mcp-server-on-push-main
   namespace: agentic-cluster-security-suite-tenant
 spec:
   params:
@@ -68,6 +65,10 @@ spec:
     - linux/arm64
     - linux/ppc64le
     - linux/s390x
+  - name: extra-labels
+    value:
+    # X.Y in the cpe label must be adjusted for every version stream.
+    - "cpe=cpe:/a:redhat:agentic_cluster_security_suite:X.Y::el9"
 
   pipelineRef:
     name: basic-component-pipeline

.tekton/acs-mcp-server-push-release.yaml

@@ -0,0 +1,85 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/stackrox/stackrox-mcp?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/max-keep-runs: "10"
+    pipelinesascode.tekton.dev/on-label: "[]"
+    # For push trigger:
+    # - trigger on commit push on release branches.
+    # - trigger on tag pushes.
+    # For PR triggers:
+    # - body.action != "ready_for_review" prevents double-triggering when a draft PR is marked ready for review.
+    # - trigger only for PRs on release branches with label: "konflux-build"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        event == "push" && target_branch.matches("^(release-.*|refs/tags/.*)$")
+      ) || (
+        event == "pull_request" &&
+        target_branch.startsWith("release-") &&
+        body.action != "ready_for_review" &&
+        has(body.pull_request) &&
+        has(body.pull_request.labels) &&
+        body.pull_request.labels.exists(l, l.name == "konflux-build")
+      )
+  labels:
+    appstudio.openshift.io/application: agentic-cluster-security-suite
+    appstudio.openshift.io/component: acs-mcp-server
+    pipelines.appstudio.openshift.io/type: build
+  name: acs-mcp-server-on-push-release
+  namespace: agentic-cluster-security-suite-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image-repo
+    value: quay.io/redhat-user-workloads/agentic-cluster-security-suite-tenant/acs-mcp-server
+  - name: dockerfile
+    value: konflux.Dockerfile
+  - name: hermetic
+    value: 'true'
+  - name: prefetch-input
+    value: |
+      [
+        { "type": "gomod", "path": "." },
+        { "type": "rpm", "path": "." }
+      ]
+  - name: build-source-image
+    value: 'true'
+  - name: build-image-index
+    value: 'true'
+  - name: clone-depth
+    value: '0'
+  - name: clone-fetch-tags
+    value: 'true'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: extra-labels
+    value:
+    # X.Y in the cpe label must be adjusted for every version stream.
+    - "cpe=cpe:/a:redhat:agentic_cluster_security_suite:X.Y::el9"
+
+  pipelineRef:
+    name: basic-component-pipeline
+
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-acs-mcp-server
+
+  timeouts:
+    tasks: 1h
+    finally: 10m
+    pipeline: 1h10m
+
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/basic-component-pipeline.yaml

@@ -170,6 +170,73 @@ spec:
     workspaces:
     - name: basic-auth
       workspace: git-auth
+
+  - name: determine-version
+    params:
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
+    runAfter:
+    - clone-repository
+    taskSpec:
+      params:
+      - name: SOURCE_ARTIFACT
+        type: string
+      - name: TRUSTED_ARTIFACT_IMAGE
+        type: string
+        default: "quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:9b180776a41d9a22a1c51539f1647c60defbbd55b44bbebdd4130e33512d8b0d"
+      - name: UBI_MINIMAL_IMAGE
+        type: string
+        default: "registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:2e8edce823a48e51858f1fad3ff4cbf6875ce8a3f86b9eecf298bc2050c8652a"
+      results:
+      - name: VERSION
+        description: Version string derived from git tags.
+      volumes:
+      - name: workdir
+        emptyDir: {}
+      stepTemplate:
+        volumeMounts:
+        - mountPath: /var/workdir
+          name: workdir
+        computeResources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            memory: 512Mi
+      steps:
+      - name: use-trusted-artifact
+        image: $(params.TRUSTED_ARTIFACT_IMAGE)
+        args:
+        - use
+        - $(params.SOURCE_ARTIFACT)=/var/workdir/source
+      - name: determine-version
+        image: $(params.UBI_MINIMAL_IMAGE)
+        workingDir: /var/workdir/source
+        script: |
+          #!/usr/bin/env bash
+          set -euo pipefail
+          microdnf install -y git-core
+          VERSION=$(git describe --tags --always)
+          echo "Determined version: ${VERSION}" >&2
+          echo -n "${VERSION}" | tee "$(results.VERSION.path)"
+
+  - name: generate-labels
+    params:
+    - name: label-templates
+      value:
+      - release=$ACTUAL_DATE_EPOCH
+    runAfter:
+    - clone-repository
+    taskRef:
+      params:
+      - name: name
+        value: generate-labels
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-generate-labels:0.1@sha256:d4ae1177fc2df0c07089bc30406ce75761cb7de21f361b254bf4dce8a5537e48
+      - name: kind
+        value: task
+      resolver: bundles
+
   - name: prefetch-dependencies
     params:
     - name: input
@@ -223,6 +290,7 @@ spec:
     - name: BUILD_ARGS
       value:
       - $(params.build-args[*])
+      - VERSION=$(tasks.determine-version.results.VERSION)
     - name: BUILD_ARGS_FILE
       value: $(params.build-args-file)
     - name: PRIVILEGED_NESTED
@@ -232,7 +300,9 @@ spec:
     - name: BUILDAH_FORMAT
       value: $(params.buildah-format)
     - name: LABELS
-      value: ["$(params.extra-labels[*])"]
+      value:
+      - $(tasks.generate-labels.results.labels[*])
+      - $(params.extra-labels[*])
     - name: BUILD_TIMESTAMP
       value: "$(tasks.clone-repository.results.commit-timestamp)"
     - name: IMAGE_APPEND_PLATFORM
@@ -488,6 +558,7 @@ spec:
     - name: BUILD_ARGS
       value:
       - $(params.build-args[*])
+      - VERSION=$(tasks.determine-version.results.VERSION)
     - name: BUILD_ARGS_FILE
       value: $(params.build-args-file)
     - name: SOURCE_ARTIFACT

konflux.Dockerfile

@@ -58,6 +58,24 @@ RUN dnf install -y \
 # Stage 4: Runtime - Minimal runtime image
 FROM ubi-micro-base
 
+# Build arguments for labels
+ARG VERSION=dev
+
+# Define labels
+LABEL \
+    com.redhat.component="agentic-cluster-security-suite-acs-mcp-server-container" \
+    com.redhat.license_terms="https://www.redhat.com/agreements" \
+    description="The ACS MCP Server" \
+    io.k8s.description="The ACS MCP Server" \
+    io.k8s.display-name="acs-mcp-server" \
+    io.openshift.tags="acs-mcp-server" \
+    maintainer="Red Hat, Inc." \
+    name="agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9" \
+    source-location="https://github.com/stackrox/stackrox-mcp" \
+    summary="The ACS MCP Server" \
+    version="${VERSION}" \
+    release="1"
+
 # Set default environment variables
 ENV LOG_LEVEL=INFO