[kdacosta0]

Problem

securesign/sigstore-e2e is changing so that CLI_STRATEGY=openshift requires a CLI_CGW_VERSION environment variable. There is no default and no fallback: if the variable is missing, the strategy now returns an error and the run fails outright. That change is SECURESIGN-6181, in sigstore-e2e PRs #103 (→ main) and #108 (→ release-1.5), not yet merged.

Two Tekton tasks in this repo run sigstore-e2e with CLI_STRATEGY: "openshift" and do not set CLI_CGW_VERSION:

• tasks/integration-test/sigstore-e2e.yaml
• tasks/integration-test/sigstore-e2e-pkcs11.yaml

Both clone sigstore-e2e at $(params.releaseBranch), which defaults to main, so they have no pin to shield them and will pick up the change the moment it merges, breaking these tasks.

Until now, they were silently falling back to a hardcoded RHTAS 1.4.2 and validating the wrong CLI binaries. Setting CLI_CGW_VERSION=1.5.0 explicitly fixes that too, pinning them to the newest version confirmed published on the Red Hat content gateway.

Note: tasks/integration-test/ansible/run-sigstore-e2e-tests.yaml is deliberately not touched — it uses CLI_STRATEGY: cli_server, which is unaffected by this change.

Merge ordering

This PR should land before sigstore-e2e PRs #103 and #108, so these tasks never run against a sigstore-e2e build that requires CLI_CGW_VERSION without it being set.

Jira

https://redhat.atlassian.net/browse/SECURESIGN-6181

Test plan

• git diff shows only the intended 3-line additions per file, nothing removed
• Both YAML files parse successfully
• Not run: the actual Tekton tasks (no cluster access from this change)

🤖 Generated with Claude Code

[qodo-for-securesign]

PR Summary by Qodo

Set the content gateway CLI version for OpenShift E2E tasks

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Set CLI_CGW_VERSION=1.5.0 in both OpenShift-strategy Tekton E2E tasks.
• Prevent failures when sigstore-e2e requires the variable and stop testing the fallback 1.4.2
 binaries.

Diagram

graph TD
  Standard["Standard E2E task"] --> Version["CLI version 1.5.0"] --> Strategy["OpenShift CLI strategy"] --> Gateway["Content gateway"]
  PKCS11["PKCS11 E2E task"] --> Version

Loading

High-Level Assessment

Setting the required environment variable in each affected task is the smallest reliable change. Parameterizing the version would add configuration without addressing another need shown by this diff.

Files changed (2) +6 / -0

Bug fix (2) +6 / -0

sigstore-e2e-pkcs11.yamlPin the PKCS#11 E2E task to gateway CLI version 1.5.0 +3/-0

Pin the PKCS#11 E2E task to gateway CLI version 1.5.0

• Adds 'CLI_CGW_VERSION' to the OpenShift-strategy test step so it supplies the required version and does not use the older fallback binaries.

tasks/integration-test/sigstore-e2e-pkcs11.yaml

sigstore-e2e.yamlPin the standard E2E task to gateway CLI version 1.5.0 +3/-0

Pin the standard E2E task to gateway CLI version 1.5.0

• Adds the same required version to the standard OpenShift-strategy test step, keeping it compatible with the upcoming sigstore-e2e requirement.

tasks/integration-test/sigstore-e2e.yaml

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[kdacosta0]

Closing this without merging: sigstore-e2e's openshift CLI strategy now maintains its own sensible default (latest published GA version) internally — see SECURESIGN-6181 and securesign/sigstore-e2e#103 / #108 — so pipelines doesn't need to pin CLI_CGW_VERSION here at all.

Separately, hardcoding a single CLI_CGW_VERSION value in this repo would be wrong regardless: pipelines has no per-RHTAS-line branches (no release-1.4/release-1.5, etc.) — just one long-lived main serving every line — so a fixed version would be correct for some lines and wrong for others.

Reverted the added CLI_CGW_VERSION entries in tasks/integration-test/sigstore-e2e.yaml and tasks/integration-test/sigstore-e2e-pkcs11.yaml back to match main (diff against main is now empty), leaving the pre-existing CLI_STRATEGY: "openshift" entries untouched.