chore(EC-2153): move POLICY_BUNDLE_DIGEST default from tasks to pipeline

docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc

@@ -62,8 +62,6 @@ paths can be provided by using the `:` separator.
 *Default*: `false`
 *EXTRA_RULE_DATA* (`string`):: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..."
 *POLICY_BUNDLE_DIGEST* (`string`):: Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@<digest>. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...).
-+
-*Default*: `sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2`
 *WORKERS* (`string`):: Number of parallel workers to use for policy evaluation.
 
 +

docs/modules/ROOT/pages/verify-enterprise-contract.adoc

@@ -73,8 +73,6 @@ paths can be provided by using the `:` separator.
 *Default*: `false`
 *EXTRA_RULE_DATA* (`string`):: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..."
 *POLICY_BUNDLE_DIGEST* (`string`):: Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@<digest>. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...).
-+
-*Default*: `sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2`
 *WORKERS* (`string`):: Number of parallel workers to use for policy evaluation.
 +
 *Default*: `1`

features/__snapshots__/ta_task_validate_image.snap

@@ -1,7 +1,6 @@
 
 [TestFeatures/Golden container image with trusted artifacts:pin-policy-bundle - 1]
-Applying policy bundle digest override: sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2
-'oci::quay.io/conforma/release-policy:konflux' not found in policy configuration, nothing to do.
+POLICY_BUNDLE_DIGEST is empty, skipping policy bundle digest override.
 
 ---
 

features/__snapshots__/task_validate_image.snap

@@ -40,8 +40,7 @@ Error: Get "http://tuf.invalid/root.json": dial tcp: lookup tuf.invalid on 10.96
 ---
 
 [TestFeatures/Golden container image:pin-policy-bundle - 1]
-Applying policy bundle digest override: sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2
-'oci::quay.io/conforma/release-policy:konflux' not found in policy configuration, nothing to do.
+POLICY_BUNDLE_DIGEST is empty, skipping policy bundle digest override.
 
 ---
 

hack/update-policy-digest-in-tasks.sh

@@ -15,20 +15,20 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-# Update the POLICY_BUNDLE_DIGEST default value in tekton task definitions.
+# Update the POLICY_BUNDLE_DIGEST default value in the enterprise-contract
+# pipeline definition and related docs/tests.
 
 set -o errexit
 set -o nounset
 set -o pipefail
 
 IMAGE="${IMAGE:-"quay.io/conforma/release-policy:konflux"}"
 
-# The two task definitions are the important placess where the digest
-# should update, but it also appears in some tests, and in the docs.
-# Update all those files as well so the change is ready to merge.
+# The pipeline definition is the primary place where the digest default
+# lives. The docs and test features also reference it and should be kept
+# in sync.
 FILES=(
-  tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml
-  tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml
+  pipelines/enterprise-contract/0.1/enterprise-contract.yaml
   docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc
   docs/modules/ROOT/pages/verify-enterprise-contract.adoc
   features/__snapshots__/task_validate_image.snap

pipelines/enterprise-contract/0.1/enterprise-contract.yaml

@@ -79,6 +79,14 @@ spec:
       type: string
       description: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..."
       default: ""
+    - name: POLICY_BUNDLE_DIGEST
+      type: string
+      description: >-
+        OCI digest to pin the release policy bundle. The task resolves the
+        policy configuration and replaces oci::quay.io/conforma/release-policy:konflux
+        with oci::quay.io/conforma/release-policy@<digest>.
+      # To update this digest use the script in hack/update-policy-digest-in-tasks.sh
+      default: "sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2"
     - name: SINGLE_COMPONENT
       type: string
       description: Reduce the Snapshot to only the component whose build caused the Snapshot to be created
@@ -154,6 +162,8 @@ spec:
           value: "$(params.CA_TRUST_CONFIG_MAP_KEY)"
         - name: EXTRA_RULE_DATA
           value: "$(params.EXTRA_RULE_DATA)"
+        - name: POLICY_BUNDLE_DIGEST
+          value: "$(params.POLICY_BUNDLE_DIGEST)"
         - name: SINGLE_COMPONENT
           value: "$(params.SINGLE_COMPONENT)"
         - name: SINGLE_COMPONENT_CUSTOM_RESOURCE

tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml

@@ -169,13 +169,7 @@ spec:
         oci::quay.io/conforma/release-policy:konflux is replaced with
         oci::quay.io/conforma/release-policy@<digest>. Accepts a full digest
         (sha256:abc123...) or just the hex hash (abc123...).
-      # For Konflux stability we want to try pinning the policy bundle rather
-      # than use the floating oci::quay.io/conforma/release-policy:konflux tag.
-      # Instead of needing to bump this in hundreds of separate ECPs, we'll do
-      # it here instead. If you don't want this behavior then provide an empty
-      # string value for this param. To update this digest use the script in
-      # hack/update-policy-digest-in-tasks.sh
-      default: "sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2"
+      default: ""
 
     - name: WORKERS
       type: string

tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml

@@ -176,13 +176,7 @@ spec:
         oci::quay.io/conforma/release-policy:konflux is replaced with
         oci::quay.io/conforma/release-policy@<digest>. Accepts a full digest
         (sha256:abc123...) or just the hex hash (abc123...).
-      # For Konflux stability we want to try pinning the policy bundle rather
-      # than use the floating oci::quay.io/conforma/release-policy:konflux tag.
-      # Instead of needing to bump this in hundreds of separate ECPs, we'll do
-      # it here instead. If you don't want this behavior then provide an empty
-      # string value for this param. To update this digest use the script in
-      # hack/update-policy-digest-in-tasks.sh
-      default: "sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2"
+      default: ""
 
     - name: WORKERS
       type: string