Propagate error to Run resources
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 277
- Forks
- 164
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 61
Description
Feature request
When Chains fails to process a TaskRun/PipelineRun for whatever reason, it adds the annotation chains.tekton.dev/signed with the value failed to the corresponding resource.
It would be beneficial to users/clients if they had some information about why signing failed. Let's introduce a mechanism that allows a user/client to view the failure reason without requiring access to the Chains controller logs.
Use case
Chains may fail to produce signatures and attestations for all kinds of reasons. Some of it may be due to an user error, e.g. failing to link the secret to the service account. As a regular user, without access to the controller, I want some visibility into why Chains failed to process my PipelineRun.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how Chains processes TaskRun and PipelineRun resources and adds the chains.tekton.dev/signed=failed annotation. Define how a failure reason should be exposed on the corresponding resource without controller-log access, then verify the behavior for signing and attestation failures and user configuration errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100