[ngelman1]

Changes

The v2alpha4 SLSA provenance formatter now produces more meaningful byProduct and resolvedDependencies resource descriptor names by:

1. Including the step name as a path segment, so consumers can identify
   which step produced each result.
2. Using the tekton.dev/pipelineTask label instead of the Kubernetes-
   generated TaskRun name, so the task identifier is stable across runs and
   matches what the Pipeline author defined.
3. Resolved dependency names for pipeline tasks now include the task name instead of the generic "pipelineTask" string

For example, byProduct-

Before:

stepResults/{k8s-generated-TaskRun-name}/{resultName}
"name": "stepResults/my-pipeline-run-xk8f2-my-build/build-log"

After:

stepResults/{pipelineTaskLabel}/{stepName}/{resultName}
"name": "stepResults/my-build/build/build-log"

And for resolvedDependency:

Before:

"name": "pipelineTask"

After:

"name": "pipelineTask/my-clone-task"

Builds on #1461 which added object names to byProduct paths.

Tested on a kind cluster, testing gist for byProduct:
https://gist.github.com/ngelman1/89e96ec2ac78702da8bfcd2d0c9b55ba
results should show-

"name": "taskRunResults/my-build/build-output"
"name": "taskRunResults/my-test/test-status"

gist to test resolvedDependencies:
https://gist.github.com/ngelman1/ed4b146aaed306831aeea75c3761dfa2
results should show-
"name": "pipelineTask/my-clone-task",

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Has Docs included if any changes are user facing
• Has Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

Improved byProduct and resolvedDependency naming in SLSA v2alpha4 provenance: step results now include the step name (`stepResults/{pipelineTask}/{stepName}/{resultName}`) and all byProducts use the `tekton.dev/pipelineTask` label and resolvedDependency now include task name.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.67%. Comparing base (7f54380) to head (a88f937).
⚠️ Report is 20 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2041      +/-   ##
==========================================
+ Coverage   72.55%   79.67%   +7.12%     
==========================================
  Files          58       58              
  Lines        3855     3405     -450     
==========================================
- Hits         2797     2713      -84     
+ Misses        764      690      -74     
+ Partials      294        2     -292     

Flag	Coverage Δ
unit-tests	79.67% <ø> (+7.12%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jkhelil]

/retest

[jkhelil]

@ngelman1 can you check why tests are not passing please ?

[ngelman1]

According to logs looks like http mistamch with registry server:

> http: server gave HTTP response to HTTPS client
but I see in all new PRs CI is failing due to this

[jkhelil]

@ngelman1
All e2e-tests matrix jobs fail on:
TestExamples/pipelinerun-no-repeated-subjects-v2alpha4/.../pipeline-with-repeated-results.yaml

can you update the e2e with expected byProduct names

[jkhelil]

@ngelman1 regarding this

Identify the name of the pipelineTask/pipelineRun/taskRun/Step using the remote resource (Pipeline, Task, StepAction) in the resolved dependencies and byProducts. This will help with completeness.

from #1160

there is still a gap in this PR on
Resolved dependencies
Remote Pipeline / Task / StepAction entries should clearly name who used them (pipelineTask, Step, etc.) in resolved dependencies

You have added only to byProduct but you need also to refernce remote names in resolved dependencies
there should be a correlation
byProduct: stepResults/produce-results/write-log/build-log
↔
resolvedDependency for the remote StepAction/Task that produced it

[jkhelil]

@ngelman1 can you add to PR description any gist file or example for a reproducer for anyone wants to play this PR

[ngelman1]

You have added only to byProduct but you need also to refernce remote names in resolved dependencies

@jkhelil Yes of course it will be added, I just wanted to separate the prs in order to keep it small and easier to review, will be same format

**update- I added all resolvedDependency changes to this pr

[jkhelil]

Please review your commit message to best fit the changes

[jkhelil]

/approve

[jkhelil]

/approve cancel

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign anithapriyanatarajan after the PR has been reviewed.
You can assign the PR to them by writing /assign @anithapriyanatarajan in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jkhelil]

lgtm

[jkhelil]

/lgtm

[anithapriyanatarajan]

@ngelman1 Thank you for this PR. As a final check, Could you confirm if storage.oci.encoding-format: sigstore-bundle, cosign > = v3.1.1 is able to list the referrers cosign tree and cosign verify of attestation work E2E. Thank you

[ngelman1]

@anithapriyanatarajan done! used cosign v3.1.4 verify and tree both work