Add Tekton task to configure sealights for Python.

[ascerra]

Description

This pull request adds a new Tekton task that makes it easier to configure Python code with Sealights for quality analytics. It retrieves the source code from a trusted artifact, installs Python Sealights agent, configures the app for sealights using vars from your pipeline run, scans all .py files that are not in the --exclude step above and reports scan to sealights, and stores results to be used later on in testing.

A README file is included with clear instructions and an example pipeline to help you get started quickly

Testing

This was tested using this PR where I created a pipeline for the todo-list python example app and ran robot tests in an integration test scenario
ascerra/todo-list-app#15

• I covered both syntax for when it is a PR and not a PR in the most recent two konflux builds.

[ascerra]

@flacatus I'm reusing some of your documentation for this.

This line here
It retrieves source code from a trusted artifact, instruments it with Sealights, and creates a new trusted artifact with the instrumented code.

I'm confused about the last "part creates a new trusted artifact with the instrumented code."
If this is happening in the go instrumentation task that you created then why in these docs do you specify
For Go projects, you need a second build task after the prefetch-dependencies task to generate a trusted artifact containing the instrumented code.

what is the difference between the create-trusted-artifact task in the go-instrumentation task and building a trusted artifact with the build-sealights-container task?

I'm just wondering if maybe I don't need the create-trusted-artifact task here for the python use case

UPDATE:
I remove the create-trusted-artifact task in the python-instrumentation task and everything worked as expected so it would seem that that step in the task is not needed. (working run is here)

[flacatus]

what is the difference between the create-trusted-artifact task in the go-instrumentation task and building a trusted artifact with the build-sealights-container task?

@ascerra Golang projects need to inject the sealights package in the source code. go-instrumentation task just instrument the code, and generate the trusted-artifact that will be passed to the build-sealights-container task to build the second container.

I'm just wondering if maybe I don't need the create-trusted-artifact task here for the python use case

No, Definetly for Pyhton and NodeJs you dont need a second build; that mean you dont need the trusted artifacts

[psturc]

just a couple of minor comments/suggestions

[psturc]

some final questions and comments 🙈

[flacatus]

@ascerra can you include the jira link in the commit?

git commit -a -m "feat(KFLUXDP-XYZ): >>commit-message<< "

[psturc]

I think this one should be removed now