Implement git submodules

Konflux doesn't have the ability to cache git
repos for hermetic builds, but it can handle git
submodules.

doc: https://git-scm.com/book/en/v2/Git-Tools-Submodules
Signed-off-by: Dale Haiducek <[email protected]>

.gitignore

@@ -2,4 +2,3 @@ build/_output/
 bin/
 gosec.json
 kubeconfig_*
-external/

.gitmodules

@@ -0,0 +1,9 @@
+[submodule "policy-cli"]
+	path = external/policy-cli
+	url = https://github.com/stolostron/policy-cli
+	branch = release-2.13
+
+[submodule "policy-generator-plugin"]
+	path = external/policy-generator-plugin
+	url = https://github.com/stolostron/policy-generator-plugin
+	branch = release-2.13

.tekton/acm-cli-acm-213-pull-request.yaml

@@ -35,7 +35,7 @@ spec:
     - name: hermetic
       value: "true"
     - name: prefetch-input
-      value: '[{"type": "gomod", "path": "."},{"type": "rpm", "path": "."}]'
+      value: '[{"type": "gomod", "path": "."},{"type": "gomod", "path": "external/policy-cli"},{"type": "gomod", "path": "external/policy-generator-plugin"},{"type": "rpm", "path": "."}]'
   pipelineSpec:
     description: |
       This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization.

.tekton/acm-cli-acm-213-push.yaml

@@ -32,7 +32,7 @@ spec:
     - name: hermetic
       value: "true"
     - name: prefetch-input
-      value: '[{"type": "gomod", "path": "."},{"type": "rpm", "path": "."}]'
+      value: '[{"type": "gomod", "path": "."},{"type": "gomod", "path": "external/policy-cli"},{"type": "gomod", "path": "external/policy-generator-plugin"},{"type": "rpm", "path": "."}]'
   pipelineSpec:
     description: |
       This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization.

Dockerfile

@@ -10,7 +10,7 @@ COPY . .
 RUN make build
 
 # Fetch and package imported binaries
-RUN make clone-build-package
+RUN make sync-build-package
 
 FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
 

Dockerfile.rhtap

@@ -10,7 +10,7 @@ COPY . .
 RUN make build
 
 # Fetch and package imported binaries
-RUN make clone-build-package
+RUN make sync-build-package
 
 FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
 

Makefile

@@ -56,19 +56,15 @@ build:
 build-image:
 	$(CONTAINER_ENGINE) build --platform linux/$(ARCH) $(BUILD_ARGS) -t $(IMAGE_NAME_AND_VERSION):$(TAG) .
 
-.PHONY: clone-build-package
-clone-build-package: clone-repos build-and-package
+.PHONY: sync-build-package
+sync-build-package: sync-repos build-and-package
 
 .PHONY: build-and-package
 build-and-package: build-binaries package-binaries
 
-.PHONY: clone-repos
-clone-repos:
-	while IFS=, read -r git_url build_cmd build_dir; do \
-		if [[ "$${git_url}" != "GIT REPO URL" ]]; then \
-			git clone --branch=${RELEASE_TAG} --depth=1 $${git_url} $(REMOTE_SOURCES_DIR)/$${git_url##*/}/$(REMOTE_SOURCES_SUBDIR); \
-		fi; \
-	done < ./build/cli_map.csv
+.PHONY: sync-repos
+sync-repos:
+	git submodule update --init
 
 .PHONY: build-binaries
 build-binaries: