Mise en place d'une chaîne d'intégration continue GitOps Cloud-Native sur OpenShift/Kubernetes

1
2
3
4

- name: build
  image: maven:3.6.0-jdk-8-slim
  command: ["mvn"]
  args: ["install"]

1
2
3
4
5
6
7

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: nfs-client
provisioner: k8s-sigs.io/nfs-subdir-external-provisioner
parameters:
  archiveOnDelete: "false"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: fruitz-deployment
  namespace: openshift-gitops
  labels:
    owner: sokube
    scope: fruitz
spec:
  description: ArgoCD Projet for the Fruitz Deploylent applications
  # Allow manifests to deploy only from this repositories 
  sourceRepos:
    -  git@gitlab.com:sokube-io/sample-apps/fruitz/fruitz-deploy.git
  # Only permit to deploy applications in the following clusters & namespaces
  destinations:
    - namespace: fruitz
      server: https://kubernetes.default.svc
  clusterResourceWhitelist:
  - group: '*'
    kind: Namespace
  # Enables namespace orphaned resource monitoring.
  orphanedResources:
    warn: false

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: fruitz-helm
  labels:
    owner: sokube
    scope: fruitz
  namespace: openshift-gitops
spec:
  # Link the ArgoCD application to the fruitz-deployment AppProject 
  project: fruitz-deployment
  # Configure the synchronization of the ArgoCD application
  syncPolicy:
    automated:
      prune: true
      selfHeal: true    
    syncOptions:
      - CreateNamespace=true
  # The specifications of the GitOps source code to be deployed in the cluster 
  source:
    path: helm
    targetRevision: redhat-opentour-geneva
    repoURL: 'git@gitlab.com:sokube-io/sample-apps/fruitz/fruitz-deploy.git'
    helm:
      valueFiles:
        - values.yaml
  # The target kubernetes cluster in which to deploy manifests  
  destination:
    server: https://kubernetes.default.svc
    namespace: fruitz

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

apiVersion: v1
kind: Secret
metadata:
  name: private-repo
  namespace: openshift-gitops
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  type: git
  url: git@gitlab.com:sokube-io/sample-apps/fruitz/fruitz-deploy.git
  sshPrivateKey: |
    -----BEGIN OPENSSH PRIVATE KEY-----
    ...
    -----END OPENSSH PRIVATE KEY-----

1

oc new-project cicd

1
2
3
4
5
6
7
8
9

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: gitlab-listener-interceptor
  namespace: cicd
spec:
  serviceAccountName: pipeline
  triggers:
    - triggerRef: gitlab-listener

1

oc -n cicd get route -ojsonpath='{.items[*].status.ingress[*].host}'

1

el-gitlab-listener-interceptor-cicd.apps.ocp-dev.infrasokube.io

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

apiVersion: triggers.tekton.dev/v1alpha1
kind: TriggerBinding
metadata:
  name: gitlab-triggerbinding
  namespace: cicd
spec:
  params:
  - name: buildRevision
    value: $(body.checkout_sha)
  - name: gitrepositoryurl
    value: $(body.repository.git_ssh_url)
  - name: buildRevisionShort
    value: $(extensions.short_sha)    
  - name: buildRevisionBranch
    value: $(extensions.branch_name)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

apiVersion: triggers.tekton.dev/v1beta1
kind: Trigger
metadata:
  name: gitlab-listener
  namespace: cicd
spec:
  serviceAccountName: pipeline
  interceptors:
    - name: gitlab 
      ref:
        name: "gitlab"
      params:
        - name: "secretRef"
          value:
            secretName: gitlab-trigger-secret
            secretKey: secretToken
        - name: "eventTypes"
          value: ["Push Hook"]
    - name: custom-parameters
      ref:
        name: "cel"
      params:
        - name: "overlays"
          value:
          - key: short_sha
            expression: "body.checkout_sha.truncate(8)"
          - key: branch_name
            expression: "body.ref.split('/')[2]"
  bindings:
    - ref: gitlab-triggerbinding
  template:
    ref: gitlab-triggertemplate

1
2
3
4
5
6
7
8

apiVersion: v1
kind: Secret
metadata:
  name: gitlab-trigger-secret
  namespace: cicd
type: Opaque
stringData:
  secretToken: "abcdefghijklmnopqrstuvwxyz0123456789ABCDEF"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

apiVersion: triggers.tekton.dev/v1alpha1
kind: TriggerTemplate
metadata:
  name: gitlab-triggertemplate
  namespace: cicd
spec:
  params:
  - name: buildRevision
    description: The Git commit revision
  - name: buildRevisionShort
    description: The Git commit revision
  - name: gitrepositoryurl
    description: The git repository url
  - name: buildRevisionBranch
    description: The git branch

  resourcetemplates:
    - apiVersion: tekton.dev/v1beta1
      kind: PipelineRun
      metadata:
        generateName: fruitz-quarkus-pipelinerun- 
      spec:
        serviceAccountName: pipeline
        pipelineRef:
          name: fruitz-quarkus
        params:
          - name: buildRevision
            value: $(tt.params.buildRevision)
          - name: buildRevisionShort
            value: $(tt.params.buildRevisionShort)
          - name: buildRevisionBranch
            value: $(tt.params.buildRevisionBranch)
        workspaces:
          - name: shared-workspace
            volumeClaimTemplate:
              spec:
                storageClassName: "nfs-client"
                accessModes:
                  - ReadWriteOnce
                resources:
                  requests:
                    storage: 1Gi
        resources:
          - name: git-source-fruitz-application
            resourceSpec:
              type: git
              params:
                - name: revision
                  value: $(tt.params.buildRevisionBranch)
                - name: url
                  value: $(tt.params.gitrepositoryurl)
          - name: git-source-fruitz-deployment
            resourceSpec:
              type: git
              params:
                - name: revision
                  value: redhat-opentour-geneva
                - name: url
                  value: git@gitlab.com:sokube-io/sample-apps/fruitz/fruitz-deploy.git

        taskRunSpecs:
          - pipelineTaskName: maven-package
            taskServiceAccountName: pipeline
            taskPodTemplate:
              volumes:
                - name: config-volume
                  configMap:
                    name: mvn-settings

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

apiVersion: tekton.dev/v1alpha1
kind: Task
metadata:
  name: maven-package
  namespace: cicd
spec:
  description: >-
    Maven packaging Task with multiple steps

  resources:
    inputs:
      - name: git-source-fruitz-application
        type: git

  workspaces:
    - name: shared-workspace

  params:
    - name: mavenSettingsPath
      type: string
      description: The location path of the maven settings file
      default: "/tmp"
    - name: mavenSettingsFileName
      type: string
      description: The name of the maven settings file
      default: "mvn-settings.xml"
    - name: mavenContainerImage
      type: string
      description: The name of maven container image
      default: maven:3.6.3-jdk-11

  results:
    - name: mavenProjectVersion
      description: The Maven project version number

  steps:
    - name: get-maven-project-version
      image: $(params.mavenContainerImage)
      workingDir: "$(resources.inputs.git-source-fruitz-application.path)"
      env:
        - name: "MAVEN_OPTS"
          value: "-Dmaven.repo.local=$(workspaces.shared-workspace.path)"
      script: |
        #!/usr/bin/env sh
        mvn -s $(params.mavenSettingsPath)/$(params.mavenSettingsFileName) help:evaluate \
          -Dexpression=project.version \
          -q -DforceStdout > $(results.mavenProjectVersion.path)
      volumeMounts:
        - name: config-volume
          mountPath: "$(params.mavenSettingsPath)"
  
    - name: maven-package
      image: $(params.mavenContainerImage)
      workingDir: "$(resources.inputs.git-source-fruitz-application.path)"
      env:
        - name: "MAVEN_OPTS"
          value: "-Dmaven.repo.local=$(workspaces.shared-workspace.path)"
      script: |
        #!/usr/bin/env sh
        mvn -s $(params.mavenSettingsPath)/$(params.mavenSettingsFileName) clean package -DskipTests
      volumeMounts:
        - name: config-volume
          mountPath: "$(params.mavenSettingsPath)"
      securityContext:
        privileged: true

    - name: copy-target-artifacts-folder
      image: $(params.mavenContainerImage)
      workingDir: "$(resources.inputs.git-source-fruitz-application.path)"
      script: |
        #!/usr/bin/env sh
        cp -R $(resources.inputs.git-source-fruitz-application.path)/target \
          $(workspaces.shared-workspace.path)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162

apiVersion: tekton.dev/v1alpha1
kind: Task
metadata:
  name: container-image-build-push
  namespace: cicd
spec:
  description: >-
    Container image build and push task with multiple steps
  
  resources:
    inputs:
      - name: git-source-fruitz-application
        type: git

  workspaces:
    - name: shared-workspace
  
  params:
    - name: dockerRegistryName
      type: string
      description: Name of Docker registry
      default: "registry.gitlab.com"
    - name: gitlabUsernameAccountName
      type: string
      description: Name of gitlab username
      default: "sokube-io"
    - name: gitlabGroupSampleAppsName
      type: string
      description: Name of gitlab group (1st level)
      default: "sample-apps"
    - name: gitlabSubGroupFruitzName
      type: string
      description: Name of gitlab subgroup (2nd level)
      default: "fruitz"
    - name: gitlabProjectFruitzQuarkusName
      type: string
      description: Name of quarkus project
      default: "fruitz-quarkus"
    - name: mavenProjectVersion
      type: string
      description: The Maven project version number
    - name: buildRevision
      type: string
      description: The Git commit revision
    - name: buildRevisionShort
      type: string
      description: The short Git commit revision
    - name: buildRevisionBranch
      type: string
    - name: mavenContainerImage
      type: string
      description: The name of maven container image
      default: maven:3.6.3-jdk-11
    - name: buildahContainerImage
      description: The location of the buildah builder image
      default: registry.redhat.io/rhel8/buildah:latest
    - name: buildahStorageDriver
      type: string
      description: Set buildah storage driver
      default: vfs
    - name: dockerfilePath
      type: string
      description: Path to the Dockerfile to build
      default: ./Dockerfile
    - name: buildContext
      type: string
      description: Path to the directory to use as context
      default: .
    - name: registryTlsVerify
      type: string
      description: Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)
      default: "true"
    - name: containerBuiltFormat
      type: string
      description: The format of the built container, oci or docker
      default: docker
    - name: buildahBuildExtraArgs
      type: string
      description: Extra parameters passed for the build command when building images.
      default: ""
    - name: buildahPushExtraArgs
      type: string
      description: Extra parameters passed for the push command when pushing images.
      default: ""
  
  results:
    - name: dockerImageFullName
      description: Full name of docker image builded
    - name: dockerImageFullTag
      description: Full name of docker image builded
    - name: IMAGE_DIGEST
      description: Digest of the image just built.

  steps:
    - name: show-informations
      image: $(params.mavenContainerImage)
      workingDir: "$(resources.inputs.git-source-fruitz-application.path)"
      script: |
        #!/usr/bin/env sh
        echo "------------------------------"
        echo "Project version: $(params.mavenProjectVersion)"
        echo "------------------------------"
        echo " "
        echo "------------------------------"
        echo "The commit ID: $(params.buildRevision)"
        echo "------------------------------"
        echo " "
        echo "------------------------------"
        echo "The short commit ID: $(params.buildRevisionShort)"
        echo "------------------------------"

    - name: retrieve-target-artifacts-folder
      image: $(params.mavenContainerImage)
      workingDir: "$(resources.inputs.git-source-fruitz-application.path)"
      script: |
        #!/usr/bin/env sh
        cp -R $(workspaces.shared-workspace.path)/target \
          $(resources.inputs.git-source-fruitz-application.path)
    
    - name: build-image
      image: $(params.buildahContainerImage)
      script: |
        # Build Image
        buildah --storage-driver=$(params.buildahStorageDriver) bud \
          $(params.buildahBuildExtraArgs) \
          --format=$(params.containerBuiltFormat) \
          --build-arg PROJECT_VERSION=$(params.mavenProjectVersion)-$(params.buildRevisionShort) \
          --build-arg BUILD_GIT_COMMIT=$(params.buildRevisionShort)  \
          --build-arg BUILD_BRANCH_NAME=$(params.buildRevisionBranch) \
          --tls-verify=$(params.registryTlsVerify) --no-cache \
          -f $(params.dockerfilePath) \
          -t $(params.dockerRegistryName)/$(params.gitlabUsernameAccountName)/$(params.gitlabGroupSampleAppsName)/$(params.gitlabSubGroupFruitzName)/$(params.gitlabProjectFruitzQuarkusName)/$(params.gitlabProjectFruitzQuarkusName):$(params.mavenProjectVersion)-$(params.buildRevisionShort) \
          $(params.buildContext)

        # Save image name to Tekton result 
        echo $(params.dockerRegistryName)/$(params.gitlabUsernameAccountName)/$(params.gitlabGroupSampleAppsName)/$(params.gitlabSubGroupFruitzName)/$(params.gitlabProjectFruitzQuarkusName)/$(params.gitlabProjectFruitzQuarkusName):$(params.mavenProjectVersion)-$(params.buildRevisionShort) \
          > $(results.dockerImageFullName.path)

        # Save project version to Tekton result 
        echo $(params.mavenProjectVersion)-$(params.buildRevisionShort) \
          > $(results.dockerImageFullTag.path)
      volumeMounts:
        - mountPath: /var/lib/containers
          name: varlibcontainers
      workingDir: "$(resources.inputs.git-source-fruitz-application.path)"

    - name: push-image
      image: $(params.buildahContainerImage)
      script: |
        buildah --storage-driver=$(params.buildahStorageDriver) push \
          $(params.buildahPushExtraArgs) \
          --tls-verify=$(params.registryTlsVerify) \
          --digestfile $(resources.inputs.git-source-fruitz-application.path)/image-digest \
          $(params.dockerRegistryName)/$(params.gitlabUsernameAccountName)/$(params.gitlabGroupSampleAppsName)/$(params.gitlabSubGroupFruitzName)/$(params.gitlabProjectFruitzQuarkusName)/$(params.gitlabProjectFruitzQuarkusName):$(params.mavenProjectVersion)-$(params.buildRevisionShort) \
          docker://$(params.dockerRegistryName)/$(params.gitlabUsernameAccountName)/$(params.gitlabGroupSampleAppsName)/$(params.gitlabSubGroupFruitzName)/$(params.gitlabProjectFruitzQuarkusName)/$(params.gitlabProjectFruitzQuarkusName):$(params.mavenProjectVersion)-$(params.buildRevisionShort)
      volumeMounts:
        - mountPath: /var/lib/containers
          name: varlibcontainers
      workingDir: "$(resources.inputs.git-source-fruitz-application.path)"
  volumes:
    - emptyDir: {}
      name: varlibcontainers

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

apiVersion: tekton.dev/v1alpha1
kind: Task
metadata:
  name: scan-trivy
  namespace: cicd
spec:
  description: >-
    Security scan with Trivy tool

  workspaces:
    - name: shared-workspace

  params:
    - name: dockerRegistryName
      type: string
      description: Name of Docker registry
      default: "registry.gitlab.com"
    - name: dockerImageFullName
      type: string
      description: Name of docker image to scan
    - name: trivyContainerImage
      type: string
      description: The name of Snyk container image
      default: aquasec/trivy:0.31.3

  steps:
    - name: trivy-scan
      image: $(params.trivyContainerImage)
      workingDir: "$(workspaces.shared-workspace.path)"
      env:
        - name: "TRIVY_AUTH_URL"
          value: "$(params.dockerRegistryName)"
        - name: "TRIVY_USERNAME"
          valueFrom:
            secretKeyRef:
              name: trivy-registry-gitlab-com-credentials
              key: gitlab-username-account
        - name: "TRIVY_PASSWORD"
          valueFrom:
            secretKeyRef:
              name: trivy-registry-gitlab-com-credentials
              key: gitlab-registry-token

      script: |
        #!/usr/bin/env sh

        ## Create trivy folder
        mkdir -p $(workspaces.shared-workspace.path)/trivy/scan_result 

        ## Show Trivy version
        echo "Trivy version:"
        trivy --version
        echo ""

        ## Show image to scan
        echo "Image to scan:"
        echo $(params.dockerImageFullName)
        
        ## Scan 
        trivy image --exit-code 0 \
          --cache-dir $(workspaces.shared-workspace.path)/trivy/.trivycache/ \
          --format table \
          $(params.dockerImageFullName)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

apiVersion: tekton.dev/v1alpha1
kind: Task
metadata:
  name: update-helm-deployment-repository
  namespace: cicd
spec:
  description: >-
    The Helm deployment repository update 

  resources:
    inputs:
      - name: git-source-fruitz-deployment
        type: git

  workspaces:
    - name: shared-workspace

  params:
    - name: buildRevision
      type: string
      description: The Git commit revision    
    - name: buildRevisionShort
      type: string
      description: The short Git commit revision
    - name: dockerImageFullTag
      type: string
    - name: toolboxContainerImage
      type: string
      description: The name of Toolbox container image
      default: samiamoura/ci-toolbox:1.1.0-fd40008e
    - name: helmDeploymentRepositoryBranch
      type: string
      description: The name of the Helm Fruitz deployment repository
      default: redhat-opentour-geneva

  steps:
    - name: update-helm-deployment-repository
      image: $(params.toolboxContainerImage)
      workingDir: "$(resources.inputs.git-source-fruitz-deployment.path)"
      script: |
        #!/usr/bin/env sh
        
        ## SSH configuration
        ls -la ~/.ssh/
        eval $(ssh-agent)
        ssh-add ~/.ssh/id_*
        
        ## Git commands
        git branch
        git checkout $(params.helmDeploymentRepositoryBranch)

        echo " "
        echo "------------------------------"
        echo "Container Image tag: $(params.dockerImageFullTag)"
        echo "------------------------------"
        echo " "
  
        ## Update the values.yaml file
        yq w -i helm/values.yaml backend.image.tag --style=double $(params.dockerImageFullTag)
        
        ## Git commands
        git --no-pager diff
        git config user.email "sami.amoura@sokube.ch"
        git config user.name "Sami Amoura"

        git add helm/values.yaml
        git commit -m "Automatic update $(params.dockerImageFullTag)"
        git push origin $(params.helmDeploymentRepositoryBranch)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

apiVersion: v1
kind: Secret
metadata:
  namespace: cicd
  name: gitlab-com-ssh-key
  annotations:
    tekton.dev/git-0: gitlab.com
type: kubernetes.io/ssh-auth
stringData:
  ssh-privatekey: |
    -----BEGIN OPENSSH PRIVATE KEY-----
    ...
    -----END OPENSSH PRIVATE KEY-----

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

apiVersion: v1
kind: Secret
metadata:
  name: gitlab-com-docker-registry-token
  namespace: cicd
  annotations:
    tekton.dev/docker-0: https://registry.gitlab.com
type: kubernetes.io/basic-auth
stringData:
  username: samiamoura
  password: MY_GITLAB_SECRET_TOKEN

1
2
3
4
5
6
7
8

apiVersion: v1
kind: Secret
metadata:
  name: trivy-registry-gitlab-com-credentials
  namespace: cicd
stringData:
  gitlab-registry-token: GITLAB_SECRET_TOKEN
  gitlab-username-account: sokube-io

1
2
3
4
5
6
7

oc -n cicd patch sa pipeline \
  --type='json' \
  -p='[{"op": "add", "path": "/secrets/0/name", "value":"gitlab-com-docker-registry-token"}]'
  
oc -n cicd patch sa pipeline \
  --type='json' \
  -p='[{"op": "add", "path": "/secrets/1/name", "value":"gitlab-com-ssh-key"}]'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: fruitz-quarkus
  namespace: cicd
spec:

  workspaces:
    - name: shared-workspace

  resources:
    - name: git-source-fruitz-application
      type: git
    - name: git-source-fruitz-deployment
      type: git
  
  params:
    - name: buildRevision
    - name: buildRevisionShort
    - name: buildRevisionBranch

  tasks:
    - name: maven-package
      taskRef:
        name: maven-package
      resources:
        inputs:
          - name: git-source-fruitz-application
            resource: git-source-fruitz-application
      workspaces:
        - name: shared-workspace
          workspace: shared-workspace

    - name: container-image-build-push
      taskRef:
        name: container-image-build-push
      params:
        - name: buildRevision
          value: $(params.buildRevision)
        - name: buildRevisionShort
          value: $(params.buildRevisionShort)
        - name: buildRevisionBranch
          value: $(params.buildRevisionBranch)
        - name: mavenProjectVersion
          value: $(tasks.maven-package.results.mavenProjectVersion)
      resources:
        inputs:
          - name: git-source-fruitz-application
            resource: git-source-fruitz-application
      workspaces:
        - name: shared-workspace
          workspace: shared-workspace
      runAfter:
        - maven-package

    - name: scan-trivy
      taskRef:
        name: scan-trivy
      params:
        - name: dockerImageFullName
          value: $(tasks.container-image-build-push.results.dockerImageFullName)
      workspaces:
        - name: shared-workspace
          workspace: shared-workspace
      runAfter:
        - container-image-build-push

    - name: update-helm-deployment-repository
      taskRef:
        name: update-helm-deployment-repository
      params:
        - name: dockerImageFullTag
          value: $(tasks.container-image-build-push.results.dockerImageFullTag)
        - name: buildRevision
          value: $(params.buildRevision)
        - name: buildRevisionShort
          value: $(params.buildRevisionShort)
      resources:
        inputs:
          - name: git-source-fruitz-deployment
            resource: git-source-fruitz-deployment    
      workspaces:
        - name: shared-workspace
          workspace: shared-workspace
      runAfter:
        - scan-trivy