Pipeline definition Task bundle policies Package

To be able to reproduce and audit builds accurately it’s important to know exactly what happens during the build. To do this Conforma requires that all tasks are defined in a set of known and trusted task bundles. This package includes rules to confirm that the tasks in a Pipeline definition are defined in task bundles, and that the task bundles are from the list of known and trusted bundles.

Package Name

  • task_bundle

Rules Included

Missing required data

Confirm the trusted_tasks rule data was provided, since it’s required by the policy rules in this package.

  • Rule type: FAILURE

  • FAILURE message: Missing required trusted_tasks data

  • Code: task_bundle.missing_required_data

  • Source

Task bundle is not trusted

For each Task in the Pipeline definition, check if the Tekton Bundle used is a trusted task.

  • Rule type: FAILURE

  • FAILURE message: Pipeline task '%s' uses an untrusted task bundle '%s'

  • Code: task_bundle.untrusted_task_bundle

  • Source

Task bundle is out of date

For each Task in the Pipeline definition, check if the Tekton Bundle used is the most recent.

  • Rule type: WARNING

  • WARNING message: Pipeline task '%s' uses an out of date task bundle '%s', new version of the Task must be used before %s

  • Code: task_bundle.out_of_date_task_bundle

  • Source

Task bundle reference is empty

Check that a valid task bundle reference is being used.

  • Rule type: FAILURE

  • FAILURE message: Pipeline task '%s' uses an empty bundle image reference

  • Code: task_bundle.empty_task_bundle_reference

  • Source

Task bundle was not used or is not defined

Check for the existence of a task bundle. This rule will fail if the task is not called from a bundle.

  • Rule type: FAILURE

  • FAILURE message: Pipeline task '%s' does not contain a bundle reference

  • Code: task_bundle.disallowed_task_reference

  • Source

Unpinned task bundle reference

Check if the Tekton Bundle used for the Tasks in the Pipeline definition is pinned to a digest.

  • Rule type: WARNING

  • WARNING message: Pipeline task '%s' uses an unpinned task bundle reference '%s'

  • Code: task_bundle.unpinned_task_bundle

  • Source