Enable hermetic builds

.tekton/governance-policy-propagator-acm-213-pull-request.yaml

@@ -32,6 +32,12 @@ spec:
       value: build/Dockerfile.rhtap
     - name: path-context
       value: .
+    - name: build-source-image
+      value: "true"
+    - name: hermetic
+      value: "true"
+    - name: prefetch-input
+      value: '[{"type": "gomod", "path": "."}]'
   pipelineSpec:
     description: |
       This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization.

.tekton/governance-policy-propagator-acm-213-push.yaml

@@ -29,6 +29,12 @@ spec:
       value: build/Dockerfile.rhtap
     - name: path-context
       value: .
+    - name: build-source-image
+      value: "true"
+    - name: hermetic
+      value: "true"
+    - name: prefetch-input
+      value: '[{"type": "gomod", "path": "."}]'
   pipelineSpec:
     description: |
       This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization.

Makefile

@@ -102,7 +102,7 @@ gosec-scan: GOSEC_ARGS=-exclude G201
 
 .PHONY: build
 build:
-	CGO_ENABLED=1 go build -o build/_output/bin/$(IMG) main.go
+	CGO_ENABLED=1 go build -mod=readonly -o build/_output/bin/$(IMG) main.go
 
 ############################################################
 # images section

build/Dockerfile

@@ -26,7 +26,12 @@ RUN  /usr/local/bin/user_setup
 
 ENTRYPOINT ["/usr/local/bin/entrypoint"]
 
-RUN microdnf update -y && \
-    microdnf clean all
-
 USER ${USER_UID}
+
+LABEL name="rhacm2/governance-policy-propagator-rhel9"
+LABEL summary="Propagate Policies to managed cluster namespaces"
+LABEL description="Propagate Policies from user namespaces to managed cluster namespaces as defined by the PlacementBinding and bound Placement."
+LABEL io.k8s.display-name="Governance policy propagator"
+LABEL io.k8s.description="Propagate Policies from user namespaces to managed cluster namespaces as defined by the PlacementBinding and bound Placement."
+LABEL com.redhat.component="acm-governance-policy-propagator-container"
+LABEL io.openshift.tags="data,images"

build/Dockerfile.rhtap

@@ -7,7 +7,6 @@ ENV COMPONENT=governance-policy-propagator
 ENV REPO_PATH=/go/src/github.com/stolostron/${COMPONENT}
 WORKDIR ${REPO_PATH}
 COPY . .
-RUN go mod vendor
 RUN make build
 
 # Stage 2: Copy the binaries from the image builder to the base image
@@ -27,7 +26,12 @@ RUN  /usr/local/bin/user_setup
 
 ENTRYPOINT ["/usr/local/bin/entrypoint"]
 
-RUN microdnf update -y && \
-    microdnf clean all
-
 USER ${USER_UID}
+
+LABEL name="rhacm2/governance-policy-propagator-rhel9"
+LABEL summary="Propagate Policies to managed cluster namespaces"
+LABEL description="Propagate Policies from user namespaces to managed cluster namespaces as defined by the PlacementBinding and bound Placement."
+LABEL io.k8s.display-name="Governance policy propagator"
+LABEL io.k8s.description="Propagate Policies from user namespaces to managed cluster namespaces as defined by the PlacementBinding and bound Placement."
+LABEL com.redhat.component="acm-governance-policy-propagator-container"
+LABEL io.openshift.tags="data,images"