Add ALLOW_CROSS_PLATFORM_IMAGES parameter support

[tommyd450]

Summary

This PR adds support for the ALLOW_CROSS_PLATFORM_IMAGES parameter to enable building images with multi-architecture parent images.

Changes

• Added ALLOW_CROSS_PLATFORM_IMAGES pipeline parameter to both docker-build-oci-ta and bundle-build-oci-ta pipelines
• Parameter defaults to false for safety
• Passes the parameter through to the buildah-oci-ta task's build-container step
• Both pipelines already use buildah-oci-ta:0.10 which supports this parameter (added in v0.10.3)

Context

This is required for CLI stack builds that use FROM --platform=<arch> statements to pull platform-specific base images. Without this parameter, buildah v0.10+ rejects cross-platform parent images with an error:

base image has architecture 'arm64', expected 'amd64'. Use a multi-arch image reference instead of a single-architecture reference, or explicitly allow cross-platform images in the build configuration

Usage

Components that need cross-platform image support can set this in their .tekton PipelineRun files:

  params:
  - name: ALLOW_CROSS_PLATFORM_IMAGES
    value: "true"

Related

• Buildah task changelog: https://github.com/konflux-ci/build-definitions/blob/main/task/buildah/CHANGELOG.md#0103
• Enables building cosign-cli-stack and similar multi-arch binary distribution images

🤖 Generated with Claude Code

[github-actions]

Configuration Diff

1 document(s) impacted:

+ 1 added
- 0 removed
! 0 modified

Diff

@@ (root level) @@
# v1/ConfigMap/rhtas-tenant/rhtas-repo-branch-versions
! + one document added:
+   ---
+   apiVersion: v1
+   data:
+     artifact-signer-ansible: 1.5.0-dev
+     artifact-signer-ansible__main: 1.5.0
+     artifact-signer-ansible__release-1.3: 1.3.5
+     artifact-signer-ansible__release-1.4: 1.4.2
+     certificate-transparency-go: 1.5.0-dev
+     certificate-transparency-go__main: 1.5.0
+     certificate-transparency-go__release-1.3: 1.3.5
+     certificate-transparency-go__release-1.4: 1.4.2
+     cosign: 1.5.0-dev
+     cosign__main: 1.5.0
+     cosign__release-1.3: 1.3.5
+     cosign__release-1.4: 1.4.2
+     fulcio: 1.5.0-dev
+     fulcio__main: 1.5.0
+     fulcio__release-1.3: 1.3.5
+     fulcio__release-1.4: 1.4.2
+     gitsign: 1.5.0-dev
+     gitsign__main: 1.5.0
+     gitsign__release-1.3: 1.3.5
+     gitsign__release-1.4: 1.4.2
+     model-transparency: 1.5.0-dev
+     model-transparency-go: 1.5.0-dev
+     model-transparency-go__main: 1.5.0
+     model-transparency-go__release-1.3: 1.3.5
+     model-transparency-go__release-1.4: 1.4.2
+     model-transparency__main: 0.1.0
+     model-validation-operator: 1.5.0-dev
+     model-validation-operator__main: 0.1.0
+     policy-controller: 1.5.0-dev
+     policy-controller-operator: 1.5.0-dev
+     policy-controller-operator__main: 1.1.0
+     policy-controller-operator__release-1.0: 1.0.1
+     policy-controller__main: 1.5.0-dev
+     policy-controller__release-1.0: 1.0.1
+     rekor: 1.5.0-dev
+     rekor-monitor: 1.5.0-dev
+     rekor-monitor__main: 1.5.0-dev
+     rekor-monitor__release-1.3: 1.3.5
+     rekor-monitor__release-1.4: 1.4.2
+     rekor-search-ui: 1.5.0-dev
+     rekor-search-ui__main: 1.5.0
+     rekor-search-ui__release-1.3: 1.3.5
+     rekor-search-ui__release-1.4: 1.4.2
+     rekor__main: 1.5.0
+     rekor__release-1.3: 1.3.5
+     rekor__release-1.4: 1.4.2
+     rhtas-console: 1.5.0-dev
+     rhtas-console-ui: 1.5.0-dev
+     rhtas-console-ui__main: 1.5.0
+     rhtas-console-ui__release-1.3: 1.3.5
+     rhtas-console-ui__release-1.4: 1.4.2
+     rhtas-console__main: 1.5.0
+     rhtas-console__release-1.3: 1.3.5
+     rhtas-console__release-1.4: 1.4.2
+     secure-sign-operator: 1.5.0-dev
+     secure-sign-operator__main: 1.5.0
+     secure-sign-operator__release-1.3: 1.3.5
+     secure-sign-operator__release-1.4: 1.4.2
+     segment-backup-job: 1.5.0-dev
+     segment-backup-job__main: 1.5.0-dev
+     segment-backup-job__release-1.3: 1.3.5
+     segment-backup-job__release-1.4: 1.4.2
+     timestamp-authority: 1.5.0-dev
+     timestamp-authority__main: 1.5.0
+     timestamp-authority__release-1.3: 1.3.5
+     timestamp-authority__release-1.4: 1.4.2
+     tough: 1.5.0-dev
+     tough__develop: 1.5.0
+     tough__release-1.3: 1.3.5
+     tough__release-1.4: 1.4.2
+     trillian: 1.5.0-dev
+     trillian__main: 1.5.0
+     trillian__release-1.3: 1.3.5
+     trillian__release-1.4: 1.4.2
+     tuf-server: 1.5.0-dev
+     tuf-server__main: 1.5.0
+     tuf-server__release-1.3: 1.3.5
+     tuf-server__release-1.4: 1.4.2
+   kind: ConfigMap
+   metadata:
+     name: rhtas-repo-branch-versions
+     namespace: rhtas-tenant

---

_{📦 Artifacts: base-output.yaml, head-output.yaml, dyff-output.txt}