build: enable hermetic builds for trillian cli-stack

[sampras343]

Summary

• Enable hermetic builds for the trillian-cli-stack component (both push and pull-request pipelines)
• Add prefetch-input with gomod cachi2 prefetch to both pipelines

Test plan

• Verify the cli-stack PR build passes with hermetic enabled

[qodo-for-securesign]

PR Summary by Qodo

Enable hermetic Tekton builds for trillian CLI stack (push + PR)

⚙️ Configuration changes ✨ Enhancement 🕐 10-20 Minutes

AI Description

• Turn on hermetic mode for trillian-cli-stack in PR and push pipelines.
• Add gomod dependency prefetch (cachi2) via prefetch-input to both pipelines.

Diagram

graph TD
  PR["PR Pipeline YAML"] --> PF["cachi2 gomod prefetch"] --> DEPS[("Go module deps") ] --> BT["cli-stack build task"]
  PUSH["Push Pipeline YAML"] --> PF
  BT --> HERM["Hermetic build"] --> IMG["Build/push image"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Set hermetic=true as the task default (remove per-pipeline override)

• ➕ Eliminates duplicated configuration across push/PR pipelines
• ➕ Ensures new pipelines inherit hermetic behavior automatically
• ➖ Harder to selectively disable hermetic for specific pipelines if needed
• ➖ May require coordination with other consumers of the shared task

2. DRY the two PipelineRun specs via a shared template/kustomize

• ➕ Single place to manage parameters like hermetic and prefetch-input
• ➕ Reduces risk of push/PR pipelines diverging over time
• ➖ Adds indirection and tooling complexity for a small config set
• ➖ May not match the repo’s existing Tekton management conventions

Recommendation: The current approach is appropriate for a targeted rollout: enabling hermetic and adding gomod prefetch consistently in both existing pipelines. If this pattern expands to more components, consider moving hermetic defaults into the shared task (or introducing a shared template) to avoid duplicated pipeline parameter blocks.

Files changed (2) +6 / -2

Other (2) +6 / -2

trillian-cli-stack-pull-request.yamlEnable hermetic mode and add gomod prefetch-input for PR builds +3/-1

Enable hermetic mode and add gomod prefetch-input for PR builds

• Adds a prefetch-input parameter for gomod cachi2 prefetch and switches the hermetic parameter from false to true for the pull-request pipeline.

.tekton/trillian-cli-stack-pull-request.yaml

trillian-cli-stack-push.yamlEnable hermetic mode and add gomod prefetch-input for push builds +3/-1

Enable hermetic mode and add gomod prefetch-input for push builds

• Adds a prefetch-input parameter for gomod cachi2 prefetch and switches the hermetic parameter from false to true for the push pipeline.

.tekton/trillian-cli-stack-push.yaml

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}