ROX-20752: scanner-slim konflux onboarding

[tommartensen]

How are scanner-slim pipelines different from scanner?

-> scanner-slim only fetches repo2cpe and genesis manifests, scanner also fetches K8s & NVD definitions
-> TARGET_STAGE points to the respective stage in the Dockerfile

Multi-stage Docker build:

We have builder-common and scanner-common stages. The final scanner-slim builds on just these two.

For full scanner, in addition to builder-common and scanner-common stages, there is a stage that unzips the K8s & NVD definitions, before all are combined in the final scanner stage.

Validation

Looking at the images and confirming that slim does not have K8s & NVD definitions.

• docker run -it --entrypoint /bin/sh quay.io/redhat-user-workloads/rh-acs-tenant/acs/scanner-slim:on-pr-1d4ab16dd540e4e82d44aededdbf6044f933e85f
• docker run -it --entrypoint /bin/sh quay.io/redhat-user-workloads/rh-acs-tenant/acs/scanner:on-pr-1d4ab16dd540e4e82d44aededdbf6044f933e85f

Do the new pipelines match?

$ diff .tekton/scanner-slim-push.yaml .tekton/scanner-slim-pull-request.yaml 
6a7
>     build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
9c10,11
<     pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "master"
---
>     # TODO(ROX-21073): re-enable for all PR branches
>     pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && (source_branch.contains("rhtap") || source_branch.contains("konflux"))
15c17
<   name: scanner-slim-on-push
---
>   name: scanner-slim-on-pull-request
24d25
<     # TODO(ROX-20230): make release images not expire.
27c28
<     value: quay.io/redhat-user-workloads/rh-acs-tenant/acs/scanner-slim:{{revision}}
---
>     value: quay.io/redhat-user-workloads/rh-acs-tenant/acs/scanner-slim:on-pr-{{revision}}

Do the slim and full pipelines match?

diff .tekton/scanner-slim-push.yaml .tekton/scanner-push.yaml
13c13
<     appstudio.openshift.io/component: scanner-slim
---
>     appstudio.openshift.io/component: scanner
15c15
<   name: scanner-slim-on-push
---
>   name: scanner-on-push
27c28
<     value: quay.io/redhat-user-workloads/rh-acs-tenant/acs/scanner-slim:{{revision}}
---
>     value: quay.io/redhat-user-workloads/rh-acs-tenant/acs/scanner:{{revision}}
242a247,248
>                   nvd-definitions.zip \
>                   k8s-definitions.zip \
266c272
<         value: scanner-slim
---
>         value: scanner

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[msugakov]

LGTM overall