From efe059a423fce2a45593930fd34b735a1b4a534a Mon Sep 17 00:00:00 2001 From: Elijah-Destigni Date: Wed, 24 Jun 2026 12:20:30 +0100 Subject: [PATCH 1/6] made prepare-molecule-test seperate file --- .../integration-test/ansible-upgrade.yaml | 36 +++++++--------- pipelines/integration-test/ansible.yaml | 36 +++++++--------- .../prepare-molecule-tests.yaml | 41 +++++++++++++++++++ 3 files changed, 69 insertions(+), 44 deletions(-) create mode 100644 tasks/integration-test/prepare-molecule-tests.yaml diff --git a/pipelines/integration-test/ansible-upgrade.yaml b/pipelines/integration-test/ansible-upgrade.yaml index b5a5698d..021aac97 100644 --- a/pipelines/integration-test/ansible-upgrade.yaml +++ b/pipelines/integration-test/ansible-upgrade.yaml @@ -57,31 +57,23 @@ spec: - name: prepare-molecule-tests runAfter: - clone-source-code + taskRef: + resolver: git + params: + - name: url + value: https://github.com/securesign/pipelines.git + - name: revision + value: main + - name: pathInRepo + value: tasks/integration-test/prepare-molecule-tests.yaml + params: + - name: container-image + value: $(tasks.parse-metadata.results.container-image) + - name: ansible-path + value: "ansible" workspaces: - name: work workspace: work - taskSpec: - workspaces: - - name: work - steps: - - name: extract-release-image-content - image: "gcr.io/go-containerregistry/crane" - args: - - export - - $(tasks.parse-metadata.results.container-image) - - $(workspaces.work.path)/image.tar - - name: prepare-tests - image: "quay.io/redhat-appstudio/konflux-test:stable" - script: | - #!/bin/sh - set -ex - - # extract the release image content - tar xf $(workspaces.work.path)/image.tar -C $(workspaces.work.path) - - # replace the tas_single_node name with the redhat.artifact_signer.tas_single_node name - find $(workspaces.work.path)/ansible/molecule -type f -name "converge.yml" \ - -exec sed -i 's@name: tas_single_node@name: redhat.artifact_signer.tas_single_node@g' {} + - name: run-upgrade-test runAfter: - prepare-molecule-tests diff --git a/pipelines/integration-test/ansible.yaml b/pipelines/integration-test/ansible.yaml index 36261e18..328fa330 100644 --- a/pipelines/integration-test/ansible.yaml +++ b/pipelines/integration-test/ansible.yaml @@ -78,31 +78,23 @@ spec: - name: output workspace: work - name: prepare-molecule-tests + taskRef: + resolver: git + params: + - name: url + value: https://github.com/securesign/pipelines.git + - name: revision + value: main + - name: pathInRepo + value: tasks/integration-test/prepare-molecule-tests.yaml + params: + - name: container-image + value: $(tasks.parse-metadata.results.container-image) + - name: ansible-path + value: "artifact-signer-ansible" workspaces: - name: work workspace: work - taskSpec: - workspaces: - - name: work - steps: - - name: extract-release-image-content - image: "gcr.io/go-containerregistry/crane" - args: - - export - - $(tasks.parse-metadata.results.container-image) - - $(workspaces.work.path)/image.tar - - name: prepare-env - image: "quay.io/redhat-appstudio/konflux-test:stable" - script: | - #!/bin/sh - set -ex - - # extract the release image content - tar xf $(workspaces.work.path)/image.tar -C $(workspaces.work.path) - - # replace the tas_single_node name with the redhat.artifact_signer.tas_single_node name - find $(workspaces.work.path)/artifact-signer-ansible/molecule -type f -name "converge.yml" \ - -exec sed -i 's@name: tas_single_node@name: redhat.artifact_signer.tas_single_node@g' {} + - name: run-molecule-tests runAfter: - prepare-molecule-tests diff --git a/tasks/integration-test/prepare-molecule-tests.yaml b/tasks/integration-test/prepare-molecule-tests.yaml new file mode 100644 index 00000000..1c0e5d40 --- /dev/null +++ b/tasks/integration-test/prepare-molecule-tests.yaml @@ -0,0 +1,41 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: prepare-molecule-tests +spec: + description: | + Extracts a container image and prepares the Ansible molecule test environment + by replacing role names in converge.yml files. + params: + - name: container-image + type: string + description: The container image URL to extract (e.g., from Snapshot) + - name: ansible-path + type: string + description: Path to the Ansible directory relative to workspace (e.g., "ansible" or "artifact-signer-ansible") + default: "ansible" + workspaces: + - name: work + description: Workspace where the image will be extracted and processed + steps: + - name: extract-release-image-content + image: "gcr.io/go-containerregistry/crane" + args: + - export + - $(params.container-image) + - $(workspaces.work.path)/image.tar + - name: prepare-env + image: "quay.io/redhat-appstudio/konflux-test:stable" + script: | + #!/bin/sh + set -ex + + # Extract the release image content + tar xf $(workspaces.work.path)/image.tar -C $(workspaces.work.path) + + # Replace the tas_single_node name with the redhat.artifact_signer.tas_single_node name + # This finds all converge.yml files in the molecule directory and updates the role name + find $(workspaces.work.path)/$(params.ansible-path)/molecule -type f -name "converge.yml" \ + -exec sed -i 's@name: tas_single_node@name: redhat.artifact_signer.tas_single_node@g' {} + + + echo "Successfully prepared molecule tests in $(params.ansible-path)" From 177459aff85658817794fbd64fcb94cc7afb3b37 Mon Sep 17 00:00:00 2001 From: Elijah-Destigni Date: Mon, 29 Jun 2026 11:20:54 +0100 Subject: [PATCH 2/6] test: add debug log to verify branch in test runs --- tasks/integration-test/prepare-molecule-tests.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tasks/integration-test/prepare-molecule-tests.yaml b/tasks/integration-test/prepare-molecule-tests.yaml index 1c0e5d40..b56b9fa7 100644 --- a/tasks/integration-test/prepare-molecule-tests.yaml +++ b/tasks/integration-test/prepare-molecule-tests.yaml @@ -30,6 +30,10 @@ spec: #!/bin/sh set -ex + echo "==========================================" + echo "๐Ÿš€ Running REFACTORED prepare-molecule-tests task from eli/dupeCode branch" + echo "==========================================" + # Extract the release image content tar xf $(workspaces.work.path)/image.tar -C $(workspaces.work.path) From 6c052d9e3e5fe9ddec6e1533378fd4122e0d2a88 Mon Sep 17 00:00:00 2001 From: Elijah-Destigni Date: Mon, 6 Jul 2026 12:06:53 +0100 Subject: [PATCH 3/6] refactor aws-cleanup --- .../integration-test/ansible-upgrade.yaml | 54 +++-------------- pipelines/integration-test/ansible.yaml | 54 +++-------------- .../aws-cleanup-ec2-instances.yaml | 58 +++++++++++++++++++ 3 files changed, 76 insertions(+), 90 deletions(-) create mode 100644 tasks/integration-test/aws-cleanup-ec2-instances.yaml diff --git a/pipelines/integration-test/ansible-upgrade.yaml b/pipelines/integration-test/ansible-upgrade.yaml index 021aac97..de985f86 100644 --- a/pipelines/integration-test/ansible-upgrade.yaml +++ b/pipelines/integration-test/ansible-upgrade.yaml @@ -180,51 +180,15 @@ spec: memory: 4Gi finally: - name: aws-cleanup + taskRef: + resolver: git + params: + - name: url + value: https://github.com/securesign/pipelines.git + - name: revision + value: main + - name: pathInRepo + value: tasks/integration-test/aws-cleanup-ec2-instances.yaml params: - name: run-id value: "$(context.pipelineRun.name)" - taskSpec: - params: - - name: run-id - volumes: - - name: aws-creds - secret: - secretName: aws-ci-test - steps: - - name: terminate-instances - volumeMounts: - - name: aws-creds - mountPath: /creds - image: amazon/aws-cli:latest - env: - - name: AWS_DEFAULT_REGION - value: "eu-north-1" - script: | - #!/bin/bash - set -eu - - set +x - export AWS_SECRET_ACCESS_KEY=$(cat /creds/AWS_ACCESS_KEY) - export AWS_ACCESS_KEY_ID=$(cat /creds/AWS_ACCESS_KEY_ID) - set -x - - # Check for credentials before proceeding (crucial step) - if [ -z "${AWS_ACCESS_KEY_ID}" ]; then - echo "ERROR: AWS_ACCESS_KEY_ID environment variable is missing." >&2 - exit 1 - fi - - INSTANCE_LIST=$( - aws ec2 describe-instances \ - --filters "Name=tag:Name,Values=CI-$(params.run-id)*" "Name=instance-state-name,Values=running,pending" \ - --query 'Reservations[].Instances[].InstanceId' \ - --output text - ) - echo "Instance IDs received for termination: ${INSTANCE_LIST} in ${AWS_DEFAULT_REGION}..." - - aws ec2 terminate-instances \ - --instance-ids ${INSTANCE_LIST} \ - --region ${AWS_DEFAULT_REGION} \ - --output text - - echo "Termination request sent for instance ${INSTANCE_LIST}." diff --git a/pipelines/integration-test/ansible.yaml b/pipelines/integration-test/ansible.yaml index 328fa330..053ac88b 100644 --- a/pipelines/integration-test/ansible.yaml +++ b/pipelines/integration-test/ansible.yaml @@ -137,51 +137,15 @@ spec: value: tasks/integration-test/ansible/run-sigstore-e2e-tests.yaml finally: - name: aws-cleanup + taskRef: + resolver: git + params: + - name: url + value: https://github.com/securesign/pipelines.git + - name: revision + value: main + - name: pathInRepo + value: tasks/integration-test/aws-cleanup-ec2-instances.yaml params: - name: run-id value: "$(context.pipelineRun.name)" - taskSpec: - params: - - name: run-id - volumes: - - name: aws-creds - secret: - secretName: aws-ci-test - steps: - - name: terminate-instances - volumeMounts: - - name: aws-creds - mountPath: /creds - image: amazon/aws-cli:latest - env: - - name: AWS_DEFAULT_REGION - value: "eu-north-1" - script: | - #!/bin/bash - set -eu - - set +x - export AWS_SECRET_ACCESS_KEY=$(cat /creds/AWS_ACCESS_KEY) - export AWS_ACCESS_KEY_ID=$(cat /creds/AWS_ACCESS_KEY_ID) - set -x - - # Check for credentials before proceeding (crucial step) - if [ -z "${AWS_ACCESS_KEY_ID}" ]; then - echo "ERROR: AWS_ACCESS_KEY_ID environment variable is missing." >&2 - exit 1 - fi - - INSTANCE_LIST=$( - aws ec2 describe-instances \ - --filters "Name=tag:Name,Values=CI-$(params.run-id)*" "Name=instance-state-name,Values=running,pending" \ - --query 'Reservations[].Instances[].InstanceId' \ - --output text - ) - echo "Instance IDs received for termination: ${INSTANCE_LIST} in ${AWS_DEFAULT_REGION}..." - - aws ec2 terminate-instances \ - --instance-ids ${INSTANCE_LIST} \ - --region ${AWS_DEFAULT_REGION} \ - --output text - - echo "Termination request sent for instance ${INSTANCE_LIST}." diff --git a/tasks/integration-test/aws-cleanup-ec2-instances.yaml b/tasks/integration-test/aws-cleanup-ec2-instances.yaml new file mode 100644 index 00000000..fbe05078 --- /dev/null +++ b/tasks/integration-test/aws-cleanup-ec2-instances.yaml @@ -0,0 +1,58 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: aws-cleanup-ec2-instances +spec: + description: | + Terminates AWS EC2 instances created during integration tests based on run ID tag. + Uses aws-ci-test secret credentials to clean up ephemeral test infrastructure. + params: + - name: run-id + type: string + description: Pipeline run ID used to tag and identify EC2 instances to terminate + - name: aws-region + type: string + default: "eu-north-1" + description: AWS region where EC2 instances are running + volumes: + - name: aws-creds + secret: + secretName: aws-ci-test + steps: + - name: terminate-instances + volumeMounts: + - name: aws-creds + mountPath: /creds + image: amazon/aws-cli:latest + env: + - name: AWS_DEFAULT_REGION + value: "$(params.aws-region)" + script: | + #!/bin/bash + set -eu + + set +x + export AWS_SECRET_ACCESS_KEY=$(cat /creds/AWS_ACCESS_KEY) + export AWS_ACCESS_KEY_ID=$(cat /creds/AWS_ACCESS_KEY_ID) + set -x + + # Check for credentials before proceeding (crucial step) + if [ -z "${AWS_ACCESS_KEY_ID}" ]; then + echo "ERROR: AWS_ACCESS_KEY_ID environment variable is missing." >&2 + exit 1 + fi + + INSTANCE_LIST=$( + aws ec2 describe-instances \ + --filters "Name=tag:Name,Values=CI-$(params.run-id)*" "Name=instance-state-name,Values=running,pending" \ + --query 'Reservations[].Instances[].InstanceId' \ + --output text + ) + echo "Instance IDs received for termination: ${INSTANCE_LIST} in ${AWS_DEFAULT_REGION}..." + + aws ec2 terminate-instances \ + --instance-ids ${INSTANCE_LIST} \ + --region ${AWS_DEFAULT_REGION} \ + --output text + + echo "Termination request sent for instance ${INSTANCE_LIST}." From 8390fab8c2281c305e95e3bd6268f63f203256a0 Mon Sep 17 00:00:00 2001 From: Elijah-Destigni Date: Mon, 6 Jul 2026 15:45:08 +0100 Subject: [PATCH 4/6] added debugging --- tasks/integration-test/aws-cleanup-ec2-instances.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tasks/integration-test/aws-cleanup-ec2-instances.yaml b/tasks/integration-test/aws-cleanup-ec2-instances.yaml index fbe05078..a497fe87 100644 --- a/tasks/integration-test/aws-cleanup-ec2-instances.yaml +++ b/tasks/integration-test/aws-cleanup-ec2-instances.yaml @@ -31,6 +31,10 @@ spec: #!/bin/bash set -eu + echo "==========================================" + echo "๐Ÿงน Running REFACTORED aws-cleanup-ec2-instances task from eli/dupeCode branch" + echo "==========================================" + set +x export AWS_SECRET_ACCESS_KEY=$(cat /creds/AWS_ACCESS_KEY) export AWS_ACCESS_KEY_ID=$(cat /creds/AWS_ACCESS_KEY_ID) From d06268842c3ff4bd3d3a0dd13c5bf3905821fa52 Mon Sep 17 00:00:00 2001 From: Elijah-Destigni Date: Mon, 6 Jul 2026 15:59:30 +0100 Subject: [PATCH 5/6] point aws-cleanup to eli/dupeCode for testing --- pipelines/integration-test/ansible-upgrade.yaml | 2 +- pipelines/integration-test/ansible.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pipelines/integration-test/ansible-upgrade.yaml b/pipelines/integration-test/ansible-upgrade.yaml index de985f86..4d4ff7f3 100644 --- a/pipelines/integration-test/ansible-upgrade.yaml +++ b/pipelines/integration-test/ansible-upgrade.yaml @@ -186,7 +186,7 @@ spec: - name: url value: https://github.com/securesign/pipelines.git - name: revision - value: main + value: eli/dupeCode - name: pathInRepo value: tasks/integration-test/aws-cleanup-ec2-instances.yaml params: diff --git a/pipelines/integration-test/ansible.yaml b/pipelines/integration-test/ansible.yaml index 053ac88b..a831c3f5 100644 --- a/pipelines/integration-test/ansible.yaml +++ b/pipelines/integration-test/ansible.yaml @@ -143,7 +143,7 @@ spec: - name: url value: https://github.com/securesign/pipelines.git - name: revision - value: main + value: eli/dupeCode - name: pathInRepo value: tasks/integration-test/aws-cleanup-ec2-instances.yaml params: From f112e453b400a033fb8c27a7a222cf6a79139abb Mon Sep 17 00:00:00 2001 From: Elijah-Destigni Date: Thu, 9 Jul 2026 10:41:36 +0100 Subject: [PATCH 6/6] change ref to to eli/dupeCode --- pipelines/integration-test/ansible-upgrade.yaml | 2 +- pipelines/integration-test/ansible.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pipelines/integration-test/ansible-upgrade.yaml b/pipelines/integration-test/ansible-upgrade.yaml index 4d4ff7f3..f86d94cb 100644 --- a/pipelines/integration-test/ansible-upgrade.yaml +++ b/pipelines/integration-test/ansible-upgrade.yaml @@ -63,7 +63,7 @@ spec: - name: url value: https://github.com/securesign/pipelines.git - name: revision - value: main + value: eli/dupeCode - name: pathInRepo value: tasks/integration-test/prepare-molecule-tests.yaml params: diff --git a/pipelines/integration-test/ansible.yaml b/pipelines/integration-test/ansible.yaml index a831c3f5..8480e628 100644 --- a/pipelines/integration-test/ansible.yaml +++ b/pipelines/integration-test/ansible.yaml @@ -84,7 +84,7 @@ spec: - name: url value: https://github.com/securesign/pipelines.git - name: revision - value: main + value: eli/dupeCode - name: pathInRepo value: tasks/integration-test/prepare-molecule-tests.yaml params: