chore(tekton): operator console plugin pin

kubernetes/tekton/create_manifest.sh

@@ -604,6 +604,20 @@ cp "${OPERATOR_FILE}" "${OPERATOR_YAML}"
 # shellcheck disable=SC2016
 perl -0pi -e 's/^([ \t]*)- name: IMAGE_ADDONS_OC\n([ \t]*)value: image-registry\.openshift-image-registry\.svc:5000\/openshift\/cli:latest/${1}# - name: IMAGE_ADDONS_OC\n${2}# value: image-registry.openshift-image-registry.svc:5000\/openshift\/cli:latest/m' "${OPERATOR_YAML}"
 
+# Local policy: pin the console-plugin image to our locally built release
+# (the upstream release-v1.24.x tag is corrupted by a webpack caching bug;
+# see PRs for the console-plugin repo). Pin by digest so future upstream
+# tag re-publishes cannot silently break the console again. Idempotent:
+# removes any existing IMAGE_PIPELINES_CONSOLE_PLUGIN entries then appends.
+IMAGE_VALUE="registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:b087e18744c18135e4a0fc2f1c1c6e3114db02419c9933d632e67b455301cccb"
+# 1) Remove any existing IMAGE_PIPELINES_CONSOLE_PLUGIN entries (idempotent)
+perl -0pi -e 's/((- [ \t]*name: IMAGE_PIPELINES_CONSOLE_PLUGIN\n[ \t]*value: .*?\n))//mg' "${OPERATOR_YAML}"
+# 2) Insert the pinned image after IMAGE_ADDONS_PARAM_MAVEN_IMAGE value
+#    (pass image via ENV to avoid perl interpreting @ as an array ref)
+export IMAGE_PIPELINES_CONSOLE_PLUGIN="${IMAGE_VALUE}"
+perl -0pi -e 's~(IMAGE_ADDONS_PARAM_MAVEN_IMAGE\n([ \t]+value: .*?\n))~$1            - name: IMAGE_PIPELINES_CONSOLE_PLUGIN\n              value: $ENV{IMAGE_PIPELINES_CONSOLE_PLUGIN}\n~m' "${OPERATOR_YAML}"
+unset IMAGE_PIPELINES_CONSOLE_PLUGIN
+
 # Local policy: restore the rationale comment above the rbac-wildcards exemption
 # on the tekton-operator ClusterRole. yq sets the annotation value but cannot
 # emit the explanatory comment, so it is re-inserted here (idempotent: it only

kubernetes/tekton/overlays/operator/operator.yaml

@@ -1028,6 +1028,9 @@ spec:
               value: registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:718e59d9aacacbaa16be3ae247bdb8582dc4fd9cbe0c5314dfdfc8f22e4f3578
             - name: IMAGE_ADDONS_PARAM_MAVEN_IMAGE
               value: registry.redhat.io/ubi9/openjdk-17@sha256:bda04343db9f920886f81a214d539673b954ab1fe71b6917d8e7b5107231ef6a
+            - name: IMAGE_PIPELINES_CONSOLE_PLUGIN
+              value: registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:b087e18744c18135e4a0fc2f1c1c6e3114db02419c9933d632e67b455301cccb
+
             # - name: IMAGE_ADDONS_OC
             # value: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest
           image: ghcr.io/tektoncd/operator/operator-1d69a75f22dd094880847eac907fb2c1:v0.81.0@sha256:8817ebccf9a39e9f500a800a35efe0f51dd2d8fb4764a83cebd75af2403b23ff

tekton/tasks/buildah/0.7.1/README.md → tekton/tasks/buildah/0.8.0/README.md

@@ -14,27 +14,37 @@ to assemble a container image, then pushes that image to a container registry.
 ## Install the Task
 
 ```bash
-kubectl apply -f https://tekton-hub-api-openshift-pipelines.apps.okd.homelab.arthurvardevanyan.com/v1/resource/homelab/task/buildah/0.7.1/raw
+kubectl apply -f https://tekton-hub-api-openshift-pipelines.apps.okd.homelab.arthurvardevanyan.com/v1/resource/homelab/task/buildah/0.8.0/raw
 ```
 
 ## Parameters
 
 - **IMAGE**: The name (reference) of the image to build.
-- **BUILDER_IMAGE:**: The name of the image containing the Buildah tool. See
-  note below. (_default:_ quay.io/buildah/stable:v1.23.3)
+- **BUILDER_IMAGE:**: The name of the image containing the Buildah tool. (_default:_ quay.io/buildah/stable:v1.23.3)
 - **DOCKERFILE**: The path to the `Dockerfile` to execute (_default:_
   `./Dockerfile`)
 - **CONTEXT**: Path to the directory to use as context (_default:_
   `.`)
-- **TLSVERIFY**: Verify the TLS on the registry endpoint (for push/pull to a
-  non-TLS registry) (_default:_ `true`)
+- **TLSVERIFY**: Verify the TLS on the registry endpoint for push/pull to a
+  non-TLS registry (_default:_ `true`)
 - **FORMAT**: The format of the built container, oci or docker (_default:_
   `oci`)
 - **BUILD_EXTRA_ARGS**: Extra parameters passed for the build command when
   building images. (_default:_ `""`)
 - **PUSH_EXTRA_ARGS**: Extra parameters passed for the push command when
   pushing images. (_default:_ `""`)
 - **SKIP_PUSH**: Skip pushing the built image (_default:_ `false`)
+- **IMAGE_REPOSITORIES**: Comma-separated list of image repositories to push
+  the manifest to (e.g. `ghcr.io/ArthurVardevanyan/k8s-gitops-ci`). When
+  set, the task builds multi-arch (per `PLATFORMS`), assembles a manifest
+  list, and pushes the complete manifest to each repository. When empty,
+  falls back to single-arch build-and-push (backward-compatible).
+- **PLATFORMS**: Comma-separated list of platforms to build for (e.g.
+  `linux/amd64,linux/arm64`). Ignored when `IMAGE_REPOSITORIES` is empty.
+- **IMAGE_TAG_SUFFIX**: Suffix appended to each per-arch intermediate image
+  name to avoid collisions during multi-arch builds (e.g. `${ARCH}`).
+  Ignored in single-arch mode. Defaults to empty (buildah auto-generates
+  unique tags).
 
 ## Workspaces
 
@@ -45,7 +55,45 @@ kubectl apply -f https://tekton-hub-api-openshift-pipelines.apps.okd.homelab.art
 
 ## Platforms
 
-The Task can be run on `linux/amd64`, `linux/s390x`, `linux/arm64` and `linux/ppc64le` platforms.
+The Task can be run on `linux/amd64`, `linux/s390x`, `linux/arm64` and
+`linux/ppc64le` platforms. It supports multi-arch builds when
+`IMAGE_REPOSITORIES` is set — it builds each platform separately, assembles
+a manifest list with `buildah manifest`, and pushes the complete manifest
+(all of the per-arch images + the manifest list) to each `IMAGE_REPOSITORY`
+in a single `buildah manifest push` operation.
+
+## Multi-Arch Usage
+
+When `IMAGE_REPOSITORIES` is set, the task builds a multi-arch manifest
+list:
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: TaskRun
+metadata:
+  name: buildah-build-multiarch
+spec:
+  taskRef:
+    name: buildah
+  params:
+    - name: IMAGE
+      value: ghcr.io/ArthurVardevanyan/k8s-gitops-ci:latest
+    - name: IMAGE_REPOSITORIES
+      value: "ghcr.io/ArthurVardevanyan/k8s-gitops-ci"
+    - name: PLATFORMS
+      value: "linux/amd64,linux/arm64"
+    - name: IMAGE_TAG_SUFFIX
+      value: "-${ARCH}"
+  workspaces:
+    - name: source
+      persistentVolumeClaim:
+        claimName: my-source
+```
+
+This builds both `linux/amd64` and `linux/arm64` images, creates a manifest
+list tagged `ghcr.io/ArthurVardevanyan/k8s-gitops-ci:latest`, and pushes the
+complete multi-arch manifest to the registry. The intermediate per-arch
+images are cleaned up after the push.
 
 ## Usage