Merge pull request #969 from anwesha-palit-redhat/feat/SRVKP-10796

SRVKP-10796:  Manual cherry picking commits of Yarn 4 migration + CVE commits in release-v1.16.x

Author: anwesha-palit-redhat

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
-  name: nodejs-18
-  namespace: openshift
-  tag: latest
+  name: console-plugin-test-cypress
+  namespace: ci
+  tag: node20-yarn4

.github/workflows/publish_container_image.yaml

@@ -1,27 +1,41 @@
-name: publish container images
+name: Build and Publish Container
+
 on:
   push:
     branches:
       - main
       - release-v* # example: release-v1.14
+      - main_ocp_4.22
     tags: ['v*']
+  pull_request:
+    branches:
+      - main
+      - main_ocp_4.22
+  workflow_dispatch:
 
 jobs:
   setup:
     name: build container
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
 
     steps:
       - name: Checkout source code
         uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '20'
+      
+      - name: Enable Corepack
+        run: corepack enable
 
       - uses: docker/setup-buildx-action@v3
 
       - name: Login in to ghcr.io registry
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -41,5 +55,5 @@ jobs:
         run: ./scripts/build_container.sh
         env:
           SUPPORT_MULTI_ARCH: "true"
-          CONSOLE_PLUGIN_IMAGE_REPO: 'ghcr.io/${{ github.repository }}'
-          CONSOLE_PLUGIN_IMAGE_TAG: '${{ github.ref_name }}'
+          CONSOLE_PLUGIN_IMAGE_REPO: ${{ github.event_name == 'pull_request' && format('ttl.sh/{0}/console-plugin-pr-{1}', github.repository, github.event.pull_request.number) || format('ghcr.io/{0}', github.repository) }}
+          CONSOLE_PLUGIN_IMAGE_TAG: ${{ github.event_name == 'pull_request' && '24h' || github.ref_name }}

.gitignore

@@ -7,4 +7,5 @@ integration-tests/screenshots
 yarn-error.log
 .DS_Store
 *.pem
-integration-tests/cypress-a11y-report.json
+integration-tests/cypress-a11y-report.json
+.yarn/

.konflux/dockerfiles/console-plugin.Dockerfile

@@ -1,17 +1,25 @@
-ARG BUILDER=registry.redhat.io/ubi8/nodejs-18@sha256:1a109c7d4a268e897a22b87f505eef326864f5ff74d4e2b7f0706605c9c5aba5
-ARG RUNTIME=registry.redhat.io/ubi8/nginx-124@sha256:b02afddd2dd7d754bda1226fe3141f4b934f1e2fab3a1ed1ddc9bd476a8ee3e6
+ARG BUILDER=registry.redhat.io/ubi8/nodejs-20@sha256:2a71011f69e5cfc26c55d99e07d0b7ca7da25879338fdae7045cdb2ad19711da
+ARG RUNTIME=registry.redhat.io/ubi8/nginx-124@sha256:0c48ade8db59c4cf3be128bace64b23e132b587b2c3a7f53ad11380f14ad3b9b
 
 FROM $BUILDER AS builder-ui
 
 WORKDIR /go/src/github.com/openshift-pipelines/console-plugin
 COPY . .
-RUN npm install -g yarn-1.22.22.tgz
-COPY .konflux/yarn.lock .
-COPY .konflux/package.json .
-RUN set -e; for f in patches/*.patch; do echo ${f}; [[ -f ${f} ]] || continue; git apply ${f}; done
-RUN yarn install --offline --frozen-lockfile --ignore-scripts && \
+#Install Yarn
+RUN if [[ -d /cachi2/output/deps/npm/ ]]; then \
+      npm install -g /cachi2/output/deps/npm/yarnpkg-cli-dist-4.6.0.tgz; \
+      YARN_ENABLE_NETWORK=0; \
+    else \
+      echo "ERROR: Hermetic npm deps not injected"; \
+      exit 1; \
+    fi
+
+# Install dependencies & build
+USER root
+RUN CYPRESS_INSTALL_BINARY=0 yarn install --immutable && \
     yarn build
 
+
 FROM $RUNTIME
 ARG VERSION=console-plugin-1.16.4
 

.konflux/npm/package-lock.json

@@ -0,0 +1,7 @@
+{
+  "name": "yarn4-nodejs22-ubil9-minimal",
+  "version": "1.0.0",
+  "description": "Konflux image containing rebuilds for tooling to assist in building with yarn",
+  "dependencies": {
+    "@yarnpkg/cli-dist": "4.6.0"}
+}