Merge pull request #1714 from slp/install-virglrenderer

container-images: add virglrenderer to vulkan

.codespelldict

@@ -2,6 +2,7 @@ hugginface->huggingface
 ramalamay->ramalama
 ramamlama->ramalama
 olama->ollama
+lama.cpp->llama.cpp
 alterting->altering
 annotationg->annotating
 assemlbe->assemble

.codespellrc

@@ -1,15 +0,0 @@
-# https://github.com/codespell-project/codespell#using-a-config-file
-[codespell]
-
-# Comma-separated list of files to skip.
-skip = ./logos,./vendor,./.git #,bin,vendor,.git,go.sum,changelog.txt,.cirrus.yml,"RELEASE_NOTES.md,*.xz,*.gz,*.tar,*.tgz,bin2img,*ico,*.png,*.1,*.5,*.7,copyimg,*.orig,apidoc.go"
-
-# Comma separated list of words to be ignored. Words must be lowercased.
-ignore-words-list = clos,creat,ro,hastable,shouldnot,mountns,passt,assertin
-
-# Custom dictionary file that contains spelling corrections.
-# Run with option '--dictionary=-' to include also default dictionary.
-dictionary = .codespelldict
-
-# Check file names as well.
-check-filenames = true

.flake8

@@ -1,4 +1,5 @@
 [flake8]
 max-line-length = 120
 # E203,E221,E231 conflict with black formatting
-extend-ignore = E203,E221,E231,E702
+extend-ignore = E203,E221,E231,E702,F824
+extend-exclude = .venv,venv

.github/workflows/ci-images.yml

@@ -6,22 +6,19 @@ name: ci images
 on:
   pull_request:
     paths:
-      - "**/container-images/**"
+      - "container-images/**"
       - ".github/workflows/ci-images.yml"
-    paths-ignore:
-      - "**/container-images/rocm"
   push:
     branches:
       - main
     paths:
-      - "**/container-images/**"
+      - "container-images/**"
       - ".github/workflows/ci-images.yml"
-    paths-ignore:
-      - "**/container-images/rocm"
 
 jobs:
   build:
     runs-on: ubuntu-24.04
+    timeout-minutes: 120
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -52,21 +49,17 @@ jobs:
       - name: Free Disk Space Linux
         shell: bash
         run: |
-          sudo docker rmi "$(docker image ls -aq)" >/dev/null 2>&1 || true
+          sudo mkdir -m a=rwx -p /mnt/tmp /mnt/runner
+          sudo mkdir -m o=rwx -p /home/runner/.local
+          sudo chown runner:runner /mnt/runner /home/runner/.local
+          sudo mount --bind /mnt/runner /home/runner/.local
           sudo rm -rf \
             /usr/share/dotnet /usr/local/lib/android /opt/ghc \
             /usr/local/share/powershell /usr/share/swift /usr/local/.ghcup \
-            /usr/lib/jvm || true
-
-      # /mnt has ~ 65 GB free disk space. / is too small.
-      - name: Reconfigure Docker data-root
-        run: |
-          sudo mkdir -p /mnt/docker /etc/docker
-          echo '{"data-root": "/mnt/docker"}' > /tmp/daemon.json
-          sudo mv /tmp/daemon.json /etc/docker/daemon.json
-          cat /etc/docker/daemon.json
-          sudo systemctl restart docker.service
-          df -h
+            /usr/share/dotnet /usr/lib/jvm /opt/hostedtoolcache/CodeQL \
+            "$AGENT_TOOLSDIRECTORY" || true
+          sudo swapoff -a
+          sudo rm -f /mnt/Swapfile
 
       - name: Print disk space after cleanup
         shell: bash
@@ -75,4 +68,4 @@ jobs:
 
       - name: Build Images
         run: |
-          ./container_build.sh -r -c build
+          ./container_build.sh -r -c -s build

.github/workflows/ci.yml

@@ -10,13 +10,20 @@ jobs:
   lint:
     name: Lint Code
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
+      
+      - name: Install the latest version of uv and activate the environment
+        uses: astral-sh/setup-uv@v6
+        with:
+          activate-environment: true
+          
       - name: Install dependencies
         shell: bash
         run: |
           sudo apt-get update
-          sudo apt-get install -y bash codespell python3-argcomplete pipx
+          sudo apt-get install -y bash codespell python3-argcomplete
           make install-requirements
 
       - name: Run format check
@@ -27,31 +34,102 @@ jobs:
         run: |
           make lint
 
-  unit-test:
-    name: Unit Tests
+  build-image:
     runs-on: ubuntu-24.04
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
+
+      - name: Install the latest version of uv and activate the environment
+        uses: astral-sh/setup-uv@v6
+        with:
+          activate-environment: true
+
       - name: Install dependencies
         shell: bash
         run: |
+          df -h
           sudo apt-get update
-          sudo apt-get install -y bash codespell python3-argcomplete pipx
+          sudo apt-get install -y bash codespell python3-argcomplete pipx podman
           make install-requirements
 
+      - name: Upgrade to podman 5
+        run: |
+           set -e
+           # /mnt has ~ 65 GB free disk space. / is too small.
+           sudo mkdir -m a=rwx -p /mnt/tmp /mnt/runner
+           sudo mkdir -m o=rwx -p /home/runner/.local
+           sudo chown runner:runner /mnt/runner /home/runner/.local
+           sudo mount --bind /mnt/runner /home/runner/.local
+           # Enable universe repository which contains podman
+           sudo add-apt-repository "deb http://archive.ubuntu.com/ubuntu oracular universe"
+           # Update package lists
+           sudo apt-get update
+           sudo apt-get purge firefox
+           # Install specific podman version
+           sudo apt-get upgrade
+
+      - name: Build a container for CPU inferencing
+        shell: bash
+        run: |
+          ./container_build.sh build -s ramalama
+
+  unit-test:
+    name: Unit Tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install the latest version of uv and activate the environment
+        uses: astral-sh/setup-uv@v6
+        with:
+          activate-environment: true
+          
+      - name: Install dependencies
+        shell: bash
+        run: |
+          df -h
+          sudo apt-get update
+          sudo apt-get install -y bash codespell python3-argcomplete pipx podman
+          make install-requirements
+
+      - name: Upgrade to podman 5
+        run: |
+           set -e
+           # Enable universe repository which contains podman
+           sudo add-apt-repository "deb http://archive.ubuntu.com/ubuntu oracular universe"
+           # Update package lists
+           sudo apt-get update
+           sudo apt-get purge firefox
+           # Install specific podman version
+           sudo apt-get upgrade
+
       - name: Run unit tests
         run: |
           make unit-tests
 
   bats:
     runs-on: ubuntu-24.04
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
+      
+      - name: Install the latest version of uv and activate the environment
+        uses: astral-sh/setup-uv@v6
+        with:
+          activate-environment: true
+          
       - name: install bats
         shell: bash
         run: |
+           df -h
+           # /mnt has ~ 65 GB free disk space. / is too small.
+           sudo mkdir -m a=rwx -p /mnt/tmp /mnt/runner
+           sudo mkdir -m o=rwx -p /home/runner/.local
+           sudo chown runner:runner /mnt/runner /home/runner/.local
+           sudo mount --bind /mnt/runner /home/runner/.local
            sudo apt-get update
-           sudo apt-get install podman bats bash codespell python3-argcomplete pipx
+           sudo apt-get install podman bats bash codespell python3-argcomplete
            make install-requirements
 
       - name: install ollama
@@ -69,25 +147,32 @@ jobs:
            # Install specific podman version
            sudo apt-get upgrade
 
-      - name: Build a container for CPU inferencing
-        run: ./container_build.sh build ramalama
-
       - name: run bats
         run: |
+           TEMPDIR=/mnt/tmp
            make validate
            make bats
 
   bats-nocontainer:
     runs-on: ubuntu-24.04
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
+      
+      - name: Install the latest version of uv and activate the environment
+        uses: astral-sh/setup-uv@v6
+        with:
+          activate-environment: true
+          
       - name: install bats
         shell: bash
         run: |
+           df -h
            sudo apt-get update
-           sudo apt-get install podman bats bash codespell python3-argcomplete pipx git cmake libcurl4-openssl-dev
+           sudo apt-get install podman bats bash codespell python3-argcomplete git cmake libcurl4-openssl-dev
            make install-requirements
            sudo ./container-images/scripts/build_llama_and_whisper.sh
+           sudo python -m pip install . --prefix=/usr
 
       - name: install ollama
         shell: bash
@@ -110,13 +195,20 @@ jobs:
 
   docker:
     runs-on: ubuntu-24.04
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
+      
+      - name: Install the latest version of uv and activate the environment
+        uses: astral-sh/setup-uv@v6
+        with:
+          activate-environment: true
+          
       - name: install bats
         shell: bash
         run: |
            sudo apt-get update
-           sudo apt-get install bats bash codespell python3-argcomplete pipx
+           sudo apt-get install bats bash codespell python3-argcomplete
            make install-requirements
 
       - name: install ollama
@@ -151,11 +243,12 @@ jobs:
            sudo mv /tmp/daemon.json /etc/docker/daemon.json
            cat /etc/docker/daemon.json
            sudo systemctl restart docker.service
+           sudo mkdir -m a=rwx -p /mnt/tmp /mnt/runner
+           sudo mkdir -m o=rwx -p /home/runner/.local
+           sudo chown runner:runner /mnt/runner /home/runner/.local
+           sudo mount --bind /mnt/runner /home/runner/.local
            df -h
 
-      - name: Build a container for CPU inferencing
-        run: ./container_build.sh build ramalama
-
       - name: bats-docker
         run: |
            docker info
@@ -163,8 +256,20 @@ jobs:
 
   macos:
     runs-on: macos-14
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
+      
+      - name: Install the latest version of uv and activate the environment
+        uses: astral-sh/setup-uv@v6
+        with:
+          activate-environment: true
+
+      - name: install mlx-lm
+        shell: bash
+        run: |
+          uv pip install mlx-lm
+          
       - name: install golang
         shell: bash
         run: |
@@ -180,7 +285,6 @@ jobs:
         run: |
            make install-requirements
            make validate
-           pipx install .
            make bats-nocontainer
 
 # FIXME: ci script should be able to run on MAC.

.github/workflows/install_ramalama.yml

@@ -12,7 +12,7 @@ jobs:
   install_ramalama:
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest]  # Runs on Ubuntu, macOS, and Fedora
+        os: [ubuntu-latest, macos-latest]  # Runs on Ubuntu and macOS
 
     runs-on: ${{ matrix.os }}
 
@@ -21,7 +21,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set Up Dependencies (Ubuntu)
-        timeout-minutes: 10
+        timeout-minutes: 20
         if: matrix.os == 'ubuntu-latest'
         run: |
           sudo apt-get install -y lshw curl
@@ -38,12 +38,12 @@ jobs:
         run: |
           chmod +x install.sh
           ./install.sh -l
-        
+
       - name: Verify RamaLama installation
         run: |
           ramalama ls | grep NAME
-      
-      - name: Ramalama info
+
+      - name: RamaLama info
         run: |
           ramalama info
 

.github/workflows/latest.yml

@@ -1,14 +1,17 @@
 name: latest-build
 on:
-    schedule:
-    - cron: '0 0 * * *'
-    workflow_dispatch:
+  release:
+    types:
+      - published
+  workflow_dispatch:
 
 jobs:
   linux:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout ramalama
+        uses: actions/checkout@v4
+
       - name: Free Disk Space Linux
         shell: bash
         run: |
@@ -51,17 +54,27 @@ jobs:
       - name: Build a container for CPU inferencing
         run: ./container_build.sh build ramalama
 
-      - name: Run a one-line script
+      - name: Install end-to-end test requirements
+        run: |
+          sudo apt-get install bats
+          make install-requirements
+
+      - name: Run end-to-end tests
         run: make end-to-end-tests
 
   macos:
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v4
-      - name: install golang
+      - name: Checkout ramalama
+        uses: actions/checkout@v4
+
+      - name: Install end-to-end test requirements
         shell: bash
-        run: brew install go
-      - name: Run a one-line script
+        run: |
+          brew install go shellcheck bats
+          make install-requirements
+
+      - name: Run end-to-end tests
         shell: bash
         run: make end-to-end-tests
 
@@ -69,9 +82,8 @@ jobs:
     runs-on: ubuntu-24.04
     needs: [linux, macos]
     steps:
-        - uses: actions/checkout@v4
-          with:
-            ref: 's'
+        - name: Checkout ramalama
+          uses: actions/checkout@v4
 
         - name: Upgrade to podman 5
           run: |
@@ -112,19 +124,19 @@ jobs:
           run: |
              df -h
 
-        - name: install qemu-user-static
+        - name: Install qemu-user-static
           run: |
             sudo apt-get update
             sudo apt-get install qemu-user-static
 
-        - name: Login to Registry
+        - name: Login to quay
           uses: redhat-actions/podman-login@v1.7
           with:
             registry: quay.io
             username: ${{ secrets.USERNAME }}
             password: ${{ secrets.PASSWORD }}
 
-        - name: use buildah to build images for amd and aarch64
+        - name: Build images for amd64 and aarch64
           uses: redhat-actions/buildah-build@v2
           id: build_image
           with:
@@ -134,7 +146,7 @@ jobs:
               container-images/ramalama/Containerfile
             platforms: linux/amd64, linux/arm64
 
-        - name: push images to registry
+        - name: Push images to quay
           uses: redhat-actions/push-to-registry@v2.8
           with:
             image: ramalama/ramalama

.github/workflows/nightly.yml

@@ -1,14 +1,16 @@
 name: nightly-build
 on:
-    schedule:
-    - cron: '0 0 * * *'
-    workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * *' 
+  workflow_dispatch:
 
 jobs:
   linux:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout ramalama
+        uses: actions/checkout@v4
+
       - name: Free Disk Space Linux
         shell: bash
         run: |
@@ -43,20 +45,35 @@ jobs:
       - name: Docker info
         run: docker info
 
+      - name: Print disk space after cleanup
+        shell: bash
+        run: |
+           df -h
+
       - name: Build a container for CPU inferencing
         run: ./container_build.sh build ramalama
 
-      - name: Run a one-line script
+      - name: Install end-to-end test requirements
+        run: |
+          sudo apt-get install bats
+          make install-requirements
+
+      - name: Run end-to-end tests
         run: make end-to-end-tests
 
   macos:
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v4
-      - name: install golang
+      - name: Checkout ramalama
+        uses: actions/checkout@v4
+
+      - name: Install end-to-end test requirements
         shell: bash
-        run: brew install go
-      - name: Run a one-line script
+        run: |
+          brew install go shellcheck bats
+          make install-requirements
+
+      - name: Run end-to-end tests
         shell: bash
         run: make end-to-end-tests
 
@@ -64,9 +81,8 @@ jobs:
     runs-on: ubuntu-24.04
     needs: [linux, macos]
     steps:
-        - uses: actions/checkout@v4
-          with:
-            ref: 'main'
+        - name: Checkout ramalama
+          uses: actions/checkout@v4
 
         - name: Upgrade to podman 5
           run: |
@@ -84,14 +100,14 @@ jobs:
             sudo apt-get update
             sudo apt-get install qemu-user-static
 
-        - name: Login to Registry
+        - name: Login to quay
           uses: redhat-actions/podman-login@v1.7
           with:
             registry: quay.io
             username: ${{ secrets.USERNAME }}
             password: ${{ secrets.PASSWORD }}
 
-        - name: use buildah to build images for amd and aarch64
+        - name: Build images for amd64 and arm64
           uses: redhat-actions/buildah-build@v2
           id: build_image
           with:
@@ -101,7 +117,7 @@ jobs:
               container-images/ramalama/Containerfile
             platforms: linux/amd64, linux/arm64
 
-        - name: push images to registry
+        - name: Push images to quay
           uses: redhat-actions/push-to-registry@v2.8
           with:
             image: ramalama/ramalama

.gitignore

@@ -10,8 +10,14 @@ ramalama/*.patch
 dist
 .#*
 venv/
-*.container
-*.image
-*.volume
+/*.container
+/*.image
+/*.volume
 __pycache__/
 .aider*
+.coverage
+coverage.*
+htmlcov/
+.idea/
+.hypothesis/
+uv.lock

.packit-copr-rpm.sh

@@ -6,10 +6,10 @@
 
 set -exo pipefail
 
-# Get Version from HEAD
-VERSION=$(awk -F'[""]' '/version=/ {print $(NF-1)}' setup.py)
+# Extract version from pyproject.toml instead of setup.py
+VERSION=$(awk -F'[""]' ' /^\s*version\s*/ {print $(NF-1)}' pyproject.toml )
 
-SPEC_FILE=rpm/python-ramalama.spec
+SPEC_FILE=rpm/ramalama.spec
 
 # RPM Spec modifications
 

.packit.yaml

@@ -7,11 +7,11 @@ upstream_tag_template: v{version}
 packages:
   ramalama-fedora:
     pkg_tool: fedpkg
-    downstream_package_name: python-ramalama
-    specfile_path: rpm/python-ramalama.spec
+    downstream_package_name: ramalama
+    specfile_path: rpm/ramalama.spec
   ramalama-centos:
-    downstream_package_name: python-ramalama
-    specfile_path: rpm/python-ramalama.spec
+    downstream_package_name: ramalama
+    specfile_path: rpm/ramalama.spec
 
 srpm_build_deps:
   - make
@@ -26,8 +26,7 @@ jobs:
     packages: [ramalama-fedora]
     enable_net: true
     targets: &fedora_copr_targets
-      - fedora-development
-      - fedora-latest-stable
+      - fedora-all
     osh_diff_scan_after_copr_build: false
 
   # Copr builds for CentOS Stream
@@ -52,12 +51,27 @@ jobs:
     trigger: pull_request
     packages: [ramalama-fedora]
     targets: *fedora_copr_targets
+    tmt_plan: "/plans/rpm"
+    identifier: "rpm-fedora"
+
+  - job: tests
+    trigger: pull_request
+    skip_build: true
+    packages: [ramalama-fedora]
+    targets:
+      # FIXME: Validate test breaks on Fedora 41
+      - fedora-development
+      - fedora-latest-stable
+    tmt_plan: "/plans/no-rpm"
+    identifier: "no-rpm-fedora"
 
   # Tests for CentOS Stream
   - job: tests
     trigger: pull_request
     packages: [ramalama-centos]
     targets: *centos_copr_targets
+    tmt_plan: "/plans/rpm"
+    identifier: "rpm-centos"
 
   - job: propose_downstream
     trigger: release
@@ -65,7 +79,7 @@ jobs:
     dist_git_branches: &fedora_targets
       - fedora-all
       - epel10
-      - epel9
+      - epel10.0
 
   - job: koji_build
     trigger: commit
@@ -78,4 +92,4 @@ jobs:
     dist_git_branches:
       - fedora-branched # rawhide updates are created automatically
       - epel10
-      - epel9
+      - epel10.0

.pre-commit-config.yaml

@@ -0,0 +1,37 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-json
+      - id: check-toml
+      - id: check-added-large-files
+      - id: check-merge-conflict
+      - id: check-executables-have-shebangs
+      - id: check-shebang-scripts-are-executable
+  - repo: https://github.com/pycqa/flake8
+    rev: 7.3.0
+    hooks:
+      - id: flake8
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.4.1
+    hooks:
+      - id: codespell
+        args: ["-w"]
+  - repo: https://github.com/psf/black
+    rev: 25.1.0
+    hooks:
+      - id: black
+  - repo: https://github.com/pycqa/isort
+    rev: 6.0.1
+    hooks:
+      - id: isort
+  - repo: local
+    hooks:
+      - id: run-unit-tests
+        name: run unit tests
+        entry: make unit-tests
+        language: system
+        pass_filenames: false

.tekton/asahi-llama-server/asahi-llama-server-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: asahi-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: asahi-llama-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi-llama-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/asahi:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/asahi-llama-server/asahi-llama-server-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: asahi-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: asahi-llama-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi-llama-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/asahi:{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/asahi-rag/asahi-rag-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: asahi-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: asahi-rag-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi-rag:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+    - linux-d160-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/asahi:on-pr-{{revision}}
+    - GPU=cpu
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/asahi-rag/asahi-rag-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: asahi-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: asahi-rag-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi-rag:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+    - linux-d160-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/asahi:{{revision}}
+    - GPU=cpu
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/asahi-whisper-server/asahi-whisper-server-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: asahi-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: asahi-whisper-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi-whisper-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/asahi:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/asahi-whisper-server/asahi-whisper-server-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: asahi-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: asahi-whisper-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi-whisper-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/asahi:{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/asahi/asahi-pull-request.yaml

@@ -0,0 +1,42 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: asahi
+    pipelines.appstudio.openshift.io/type: build
+  name: asahi-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/asahi/Containerfile
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/asahi/asahi-push.yaml

@@ -0,0 +1,39 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: asahi
+    pipelines.appstudio.openshift.io/type: build
+  name: asahi-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/asahi:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/asahi/Containerfile
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/bats/bats-pull-request.yaml

@@ -0,0 +1,42 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: bats
+    pipelines.appstudio.openshift.io/type: build
+  name: bats-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/bats:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/bats/Containerfile
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/bats/bats-push.yaml

@@ -0,0 +1,39 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: bats
+    pipelines.appstudio.openshift.io/type: build
+  name: bats-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/bats:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/bats/Containerfile
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cann-llama-server/cann-llama-server-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cann-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: cann-llama-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann-llama-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cann:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cann-llama-server/cann-llama-server-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cann-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: cann-llama-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann-llama-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cann:{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cann-rag/cann-rag-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cann-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: cann-rag-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann-rag:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+    - linux-d160-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cann:on-pr-{{revision}}
+    - GPU=cpu
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cann-rag/cann-rag-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cann-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: cann-rag-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann-rag:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+    - linux-d160-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cann:{{revision}}
+    - GPU=cpu
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cann-whisper-server/cann-whisper-server-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cann-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: cann-whisper-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann-whisper-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cann:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cann-whisper-server/cann-whisper-server-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cann-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: cann-whisper-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann-whisper-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cann:{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cann/cann-pull-request.yaml

@@ -0,0 +1,42 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cann
+    pipelines.appstudio.openshift.io/type: build
+  name: cann-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/cann/Containerfile
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cann/cann-push.yaml

@@ -0,0 +1,39 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cann
+    pipelines.appstudio.openshift.io/type: build
+  name: cann-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cann:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/cann/Containerfile
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cuda-llama-server/cuda-llama-server-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cuda-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: cuda-llama-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda-llama-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cuda:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cuda-llama-server/cuda-llama-server-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cuda-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: cuda-llama-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda-llama-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cuda:{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cuda-rag/cuda-rag-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cuda-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: cuda-rag-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda-rag:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+    - linux-d160-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cuda:on-pr-{{revision}}
+    - GPU=cuda
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cuda-rag/cuda-rag-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cuda-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: cuda-rag-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda-rag:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+    - linux-d160-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cuda:{{revision}}
+    - GPU=cuda
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cuda-whisper-server/cuda-whisper-server-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cuda-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: cuda-whisper-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda-whisper-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cuda:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cuda-whisper-server/cuda-whisper-server-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cuda-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: cuda-whisper-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda-whisper-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/cuda:{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cuda/cuda-pull-request.yaml

@@ -0,0 +1,42 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cuda
+    pipelines.appstudio.openshift.io/type: build
+  name: cuda-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/cuda/Containerfile
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/cuda/cuda-push.yaml

@@ -0,0 +1,39 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: cuda
+    pipelines.appstudio.openshift.io/type: build
+  name: cuda-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/cuda:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/cuda/Containerfile
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/integration/pipelines/bats-integration.yaml

@@ -0,0 +1,66 @@
+kind: Pipeline
+apiVersion: tekton.dev/v1
+metadata:
+  name: bats-integration
+spec:
+  description: |
+    Test the newly-built ramalama image and layered images on all supported architectures.
+  params:
+  - name: SNAPSHOT
+    description: >-
+      Information about the components included in the current snapshot under test.
+  - name: platforms
+    description: VM platforms on which to run test commands
+    type: array
+    default:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: commands
+    description: Test commands to run
+    type: array
+    default:
+    - make bats
+  - name: git-url
+    description: URL of the Git repository containing pipeline and task definitions
+    default: https://github.com/containers/ramalama.git
+  - name: git-revision
+    description: Revision of the Git repository containing pipeline and task definitions
+    default: main
+  tasks:
+  - name: init
+    params:
+    - name: SNAPSHOT
+      value: $(params.SNAPSHOT)
+    taskRef:
+      resolver: git
+      params:
+      - name: url
+        value: $(params.git-url)
+      - name: revision
+        value: $(params.git-revision)
+      - name: pathInRepo
+        value: .tekton/integration/tasks/init-snapshot.yaml
+  - name: test
+    matrix:
+      params:
+      - name: PLATFORM
+        value:
+        - $(params.platforms)
+      - name: cmd
+        value:
+        - $(params.commands)
+    params:
+    - name: image
+      value: $(tasks.init.results.bats-image)
+    - name: envs
+      value:
+      - RAMALAMA_IMAGE=$(tasks.init.results.ramalama-image)
+    taskRef:
+      resolver: git
+      params:
+      - name: url
+        value: $(params.git-url)
+      - name: revision
+        value: $(params.git-revision)
+      - name: pathInRepo
+        value: .tekton/integration/tasks/test-vm-cmd.yaml

.tekton/integration/tasks/init-snapshot.yaml

@@ -0,0 +1,55 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: init-snapshot
+spec:
+  description: Extract information from the SNAPSHOT and make it available as Tekton results
+  params:
+  - name: SNAPSHOT
+    description: >-
+      Information about the components included in the current snapshot under test.
+  results:
+  - name: event-type
+    description: The type of event that triggered the pipeline
+  - name: bats-image
+    description: URI of the bats image included in the snapshot
+  - name: ramalama-image
+    description: URI of the ramalama image included in the snapshot
+  - name: TEST_OUTPUT
+    description: Test result in json format
+  steps:
+  - name: process
+    image: registry.access.redhat.com/ubi10/ubi:latest
+    env:
+    - name: SNAPSHOT
+      value: $(params.SNAPSHOT)
+    - name: EVENT_TYPE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.labels['pac.test.appstudio.openshift.io/event-type']
+    - name: RESULTS_EVENT_TYPE_PATH
+      value: $(results.event-type.path)
+    - name: RESULTS_BATS_IMAGE_PATH
+      value: $(results.bats-image.path)
+    - name: RESULTS_RAMALAMA_IMAGE_PATH
+      value: $(results.ramalama-image.path)
+    - name: RESULTS_TEST_OUTPUT_PATH
+      value: $(results.TEST_OUTPUT.path)
+    script: |
+      #!/bin/bash -ex
+      dnf -y install jq
+      echo -n "$EVENT_TYPE" | tee "$RESULTS_EVENT_TYPE_PATH"
+      echo
+      component_image() {
+        TAGSEP=":"
+        if [ "$EVENT_TYPE" == "pull_request" ]; then
+          TAGSEP+="on-pr-"
+        fi
+        jq -j --arg name "$1" --arg tagsep "$TAGSEP" '.components[] | select(.name == $name) | [(.containerImage | split("@")[0]), .source.git.revision] | join($tagsep)' <<< "$SNAPSHOT"
+      }
+      component_image bats | tee "$RESULTS_BATS_IMAGE_PATH"
+      echo
+      component_image ramalama | tee "$RESULTS_RAMALAMA_IMAGE_PATH"
+      echo
+      jq -jnc '{result: "SUCCESS", timestamp: now | todateiso8601, failures: 0, successes: 1, warnings: 0}' | tee "$RESULTS_TEST_OUTPUT_PATH"
+      echo

.tekton/integration/tasks/test-vm-cmd.yaml

@@ -0,0 +1,118 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: test-vm-cmd
+spec:
+  description: Run a command in a test VM
+  params:
+  - name: PLATFORM
+    description: The platform of the VM to provision
+  - name: image
+    description: The image to use when setting up the test environment
+  - name: cmd
+    description: The command to run
+  - name: envs
+    description: List of environment variables (NAME=VALUE) to be set in the test environment
+    type: array
+    default: []
+  results:
+  - name: TEST_OUTPUT
+    description: Test result in json format
+  volumes:
+  - name: workdir
+    emptyDir: {}
+  - name: ssh
+    secret:
+      secretName: multi-platform-ssh-$(context.taskRun.name)
+  steps:
+  - name: run-in-vm
+    image: registry.access.redhat.com/ubi10/ubi:latest
+    volumeMounts:
+    - mountPath: /var/workdir
+      name: workdir
+    - mountPath: /ssh
+      name: ssh
+    workingDir: /var/workdir
+    env:
+    - name: TEST_IMAGE
+      value: $(params.image)
+    - name: TEST_CMD
+      value: $(params.cmd)
+    - name: RESULTS_TEST_OUTPUT_PATH
+      value: $(results.TEST_OUTPUT.path)
+    args:
+    - $(params.envs[*])
+    script: |
+      #!/bin/bash -ex
+      log() {
+        echo "[$(date -uIns)]" $*
+      }
+
+      log Install packages
+      dnf -y install openssh-clients rsync jq
+
+      log Prepare connection
+
+      if [ -e "/ssh/error" ]; then
+        log Error provisioning VM
+        cat /ssh/error
+        exit 1
+      fi
+      export SSH_HOST=$(cat /ssh/host)
+
+      mkdir -p ~/.ssh
+      if [ "$SSH_HOST" == "localhost" ] ; then
+        IS_LOCALHOST=true
+        log Localhost detected, running build in cluster
+      elif [ -s "/ssh/otp" ]; then
+        log Fetching OTP token
+        curl --cacert /ssh/otp-ca -d @/ssh/otp $(cat /ssh/otp-server) > ~/.ssh/id_rsa
+        echo >> ~/.ssh/id_rsa
+        chmod 0400 ~/.ssh/id_rsa
+      elif [ -s "/ssh/id_rsa" ]; then
+        log Copying ssh key
+        cp /ssh/id_rsa ~/.ssh
+        chmod 0400 ~/.ssh/id_rsa
+      else
+        log No authentication mechanism found
+        exit 1
+      fi
+
+      mkdir -p scripts
+
+      PODMAN_ENV=()
+      while [ $# -ne 0 ]; do
+        PODMAN_ENV+=("-e" "$1")
+        shift
+      done
+
+      cat > scripts/test.sh <<SCRIPTEOF
+      #!/bin/bash -ex
+      podman run \
+      --userns=keep-id \
+      --security-opt label=disable \
+      --security-opt unmask=/proc/* \
+      --device /dev/net/tun \
+      --device /dev/fuse \
+      ${PODMAN_ENV[*]} \
+      $TEST_IMAGE $TEST_CMD
+      SCRIPTEOF
+      chmod +x scripts/test.sh
+
+      if ! [[ $IS_LOCALHOST ]]; then
+        log VM exec
+        export BUILD_DIR=$(cat /ssh/user-dir)
+        export SSH_ARGS="-o StrictHostKeyChecking=no -o ServerAliveInterval=60 -o ServerAliveCountMax=10"
+        # ssh once before rsync to retrieve the host key
+        ssh $SSH_ARGS "$SSH_HOST" "uname -a"
+        rsync -ra scripts "$SSH_HOST:$BUILD_DIR"
+        ssh $SSH_ARGS "$SSH_HOST" "$BUILD_DIR/scripts/test.sh"
+        log End VM exec
+      else
+        log Local exec
+        scripts/test.sh
+        log End local exec
+      fi
+
+      jq -jnc '{result: "SUCCESS", timestamp: now | todateiso8601, failures: 0, successes: 1, warnings: 0}' | tee "$RESULTS_TEST_OUTPUT_PATH"
+      echo

.tekton/intel-gpu-llama-server/intel-gpu-llama-server-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: intel-gpu-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: intel-gpu-llama-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu-llama-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/intel-gpu-llama-server/intel-gpu-llama-server-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: intel-gpu-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: intel-gpu-llama-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu-llama-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/intel-gpu-rag/intel-gpu-rag-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: intel-gpu-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: intel-gpu-rag-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu-rag:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:on-pr-{{revision}}
+    - GPU=cpu
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/intel-gpu-rag/intel-gpu-rag-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: intel-gpu-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: intel-gpu-rag-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu-rag:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:{{revision}}
+    - GPU=cpu
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/intel-gpu-whisper-server/intel-gpu-whisper-server-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: intel-gpu-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: intel-gpu-whisper-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu-whisper-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/intel-gpu-whisper-server/intel-gpu-whisper-server-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: intel-gpu-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: intel-gpu-whisper-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu-whisper-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/intel-gpu/intel-gpu-pull-request.yaml

@@ -0,0 +1,41 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: intel-gpu
+    pipelines.appstudio.openshift.io/type: build
+  name: intel-gpu-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+  - name: dockerfile
+    value: container-images/intel-gpu/Containerfile
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/intel-gpu/intel-gpu-push.yaml

@@ -0,0 +1,38 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: intel-gpu
+    pipelines.appstudio.openshift.io/type: build
+  name: intel-gpu-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/intel-gpu:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+  - name: dockerfile
+    value: container-images/intel-gpu/Containerfile
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/llama-stack/llama-stack-pull-request.yaml

@@ -0,0 +1,42 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: llama-stack
+    pipelines.appstudio.openshift.io/type: build
+  name: llama-stack-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/llama-stack:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/llama-stack/Containerfile
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/llama-stack/llama-stack-push.yaml

@@ -0,0 +1,39 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: llama-stack
+    pipelines.appstudio.openshift.io/type: build
+  name: llama-stack-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/llama-stack:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/llama-stack/Containerfile
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/musa-llama-server/musa-llama-server-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: musa-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: musa-llama-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa-llama-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/musa:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/musa-llama-server/musa-llama-server-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: musa-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: musa-llama-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa-llama-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/musa:{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/musa-rag/musa-rag-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: musa-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: musa-rag-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa-rag:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/musa:on-pr-{{revision}}
+    - GPU=musa
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/musa-rag/musa-rag-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: musa-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: musa-rag-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa-rag:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/musa:{{revision}}
+    - GPU=musa
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/musa-whisper-server/musa-whisper-server-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: musa-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: musa-whisper-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa-whisper-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/musa:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/musa-whisper-server/musa-whisper-server-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: musa-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: musa-whisper-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa-whisper-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/musa:{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/musa/musa-pull-request.yaml

@@ -0,0 +1,41 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: musa
+    pipelines.appstudio.openshift.io/type: build
+  name: musa-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+  - name: dockerfile
+    value: container-images/musa/Containerfile
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/musa/musa-push.yaml

@@ -0,0 +1,38 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: musa
+    pipelines.appstudio.openshift.io/type: build
+  name: musa-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/musa:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+  - name: dockerfile
+    value: container-images/musa/Containerfile
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/openvino/openvino-pull-request.yaml

@@ -0,0 +1,41 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: openvino
+    pipelines.appstudio.openshift.io/type: build
+  name: openvino-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/openvino:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+  - name: dockerfile
+    value: container-images/openvino/Containerfile
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/openvino/openvino-push.yaml

@@ -0,0 +1,38 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: openvino
+    pipelines.appstudio.openshift.io/type: build
+  name: openvino-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/openvino:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+  - name: dockerfile
+    value: container-images/openvino/Containerfile
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/pipelines/pull-request-pipeline.yaml

@@ -0,0 +1,640 @@
+apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: pull-request-pipeline
+  labels:
+    appstudio.openshift.io/application: ramalama
+spec:
+  description: |
+    Pipeline for building RamaLama images when PRs are submitted.
+    Based on the [docker-build-multi-platform-oci-ta](https://github.com/konflux-ci/build-definitions/tree/main/pipelines/docker-build-multi-platform-oci-ta) pipeline from [Konflux](https://konflux-ci.dev/).
+  params:
+  - description: Source Repository URL
+    name: git-url
+    type: string
+  - default: ""
+    description: Revision of the Source Repository
+    name: revision
+    type: string
+  - description: Fully Qualified Output Image
+    name: output-image
+    type: string
+  - default: .
+    description: Path to the source code of an application's component from where to build image.
+    name: path-context
+    type: string
+  - default: Dockerfile
+    description: Path to the Dockerfile inside the context specified by parameter path-context
+    name: dockerfile
+    type: string
+  - default: "false"
+    description: Force rebuild image
+    name: rebuild
+    type: string
+  - default: "true"
+    description: Skip checks against built image
+    name: skip-checks
+    type: string
+  - default: "false"
+    description: Execute the build with network isolation
+    name: hermetic
+    type: string
+  - default: ""
+    description: Build dependencies to be prefetched by Cachi2
+    name: prefetch-input
+    type: string
+  - default: ""
+    description: Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.
+    name: image-expires-after
+  - default: "false"
+    description: Build a source image.
+    name: build-source-image
+    type: string
+  - default: "true"
+    description: Add built image into an OCI image index
+    name: build-image-index
+    type: string
+  - default: []
+    description: Array of --build-arg values ("arg=value" strings) for buildah
+    name: build-args
+    type: array
+  - default: ""
+    description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file
+    name: build-args-file
+    type: string
+  - default: "false"
+    description: Whether to enable privileged mode, should be used only with remote VMs
+    name: privileged-nested
+    type: string
+  - default:
+    - linux-c4xlarge/amd64
+    description: List of platforms to build the container images on. The available set of values is determined by the configuration of the multi-platform-controller.
+    name: build-platforms
+    type: array
+  - default: ""
+    description: The parent image of the image being built.
+    name: parent-image
+  - default: ""
+    description: The image to use for running tests.
+    name: test-image
+  - default: []
+    description: List of environment variables (NAME=VALUE) to be set in the test environment.
+    name: test-envs
+    type: array
+  - default:
+    - echo "No tests defined"
+    description: List of test commands to run after the image is built.
+    name: test-commands
+    type: array
+  results:
+  - description: ""
+    name: IMAGE_URL
+    value: $(tasks.build-image-index.results.IMAGE_URL)
+  - description: ""
+    name: IMAGE_DIGEST
+    value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+  - description: ""
+    name: CHAINS-GIT_URL
+    value: $(tasks.clone-repository.results.url)
+  - description: ""
+    name: CHAINS-GIT_COMMIT
+    value: $(tasks.clone-repository.results.commit)
+  tasks:
+  - name: init
+    params:
+    - name: image-url
+      value: $(params.output-image)
+    - name: rebuild
+      value: $(params.rebuild)
+    - name: skip-checks
+      value: $(params.skip-checks)
+    taskRef:
+      params:
+      - name: name
+        value: init
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:1d8221c84f91b923d89de50bf16481ea729e3b68ea04a9a7cbe8485ddbb27ee6
+      - name: kind
+        value: task
+      resolver: bundles
+  - name: clone-repository
+    params:
+    - name: url
+      value: $(params.git-url)
+    - name: revision
+      value: $(params.revision)
+    - name: ociStorage
+      value: $(params.output-image).git
+    - name: ociArtifactExpiresAfter
+      value: $(params.image-expires-after)
+    runAfter:
+    - init
+    taskRef:
+      params:
+      - name: name
+        value: git-clone-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:d35e5d501cb5f5f88369511f76249857cb5ac30250e1dcf086939321964ff6b9
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(tasks.init.results.build)
+      operator: in
+      values:
+      - "true"
+    workspaces:
+    - name: basic-auth
+      workspace: git-auth
+  - name: prefetch-dependencies
+    params:
+    - name: input
+      value: $(params.prefetch-input)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
+    - name: ociStorage
+      value: $(params.output-image).prefetch
+    - name: ociArtifactExpiresAfter
+      value: $(params.image-expires-after)
+    runAfter:
+    - clone-repository
+    taskRef:
+      params:
+      - name: name
+        value: prefetch-dependencies-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.2@sha256:092491ac0f6e1009d10c58a1319d1029371bf637cc1293cceba53c6da5314ed1
+      - name: kind
+        value: task
+      resolver: bundles
+    workspaces:
+    - name: git-basic-auth
+      workspace: git-auth
+    - name: netrc
+      workspace: netrc
+  - name: wait-for-parent-image
+    params:
+    - name: ref
+      value: $(params.parent-image)
+    taskRef:
+      name: wait-for-image
+    when:
+    - input: $(params.parent-image)
+      operator: notin
+      values:
+      - ""
+  - matrix:
+      params:
+      - name: PLATFORM
+        value:
+        - $(params.build-platforms)
+    name: build-images
+    params:
+    - name: IMAGE
+      value: $(params.output-image)
+    - name: DOCKERFILE
+      value: $(params.dockerfile)
+    - name: CONTEXT
+      value: $(params.path-context)
+    - name: HERMETIC
+      value: $(params.hermetic)
+    - name: PREFETCH_INPUT
+      value: $(params.prefetch-input)
+    - name: IMAGE_EXPIRES_AFTER
+      value: $(params.image-expires-after)
+    - name: COMMIT_SHA
+      value: $(tasks.clone-repository.results.commit)
+    - name: BUILD_ARGS
+      value:
+      - $(params.build-args[*])
+    - name: BUILD_ARGS_FILE
+      value: $(params.build-args-file)
+    - name: PRIVILEGED_NESTED
+      value: $(params.privileged-nested)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    - name: IMAGE_APPEND_PLATFORM
+      value: "true"
+    runAfter:
+    - wait-for-parent-image
+    - prefetch-dependencies
+    taskRef:
+      params:
+      - name: name
+        value: buildah-remote-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.4@sha256:9e866d4d0489a6ab84ae263db416c9f86d2d6117ef4444f495a0e97388ae3ac0
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(tasks.init.results.build)
+      operator: in
+      values:
+      - "true"
+  - name: build-image-index
+    params:
+    - name: IMAGE
+      value: $(params.output-image)
+    - name: COMMIT_SHA
+      value: $(tasks.clone-repository.results.commit)
+    - name: IMAGE_EXPIRES_AFTER
+      value: $(params.image-expires-after)
+    - name: ALWAYS_BUILD_INDEX
+      value: $(params.build-image-index)
+    - name: IMAGES
+      value:
+      - $(tasks.build-images.results.IMAGE_REF[*])
+    runAfter:
+    - build-images
+    taskRef:
+      params:
+      - name: name
+        value: build-image-index
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:3499772af90aad0d3935629be6d37dd9292195fb629e6f43ec839c7f545a0faa
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(tasks.init.results.build)
+      operator: in
+      values:
+      - "true"
+  - name: wait-for-test-image
+    params:
+    - name: ref
+      value: $(params.test-image)
+    runAfter:
+    - build-image-index
+    taskRef:
+      name: wait-for-image
+    when:
+    - input: $(params.test-image)
+      operator: notin
+      values:
+      - ""
+  - name: run-tests
+    matrix:
+      params:
+      - name: cmd
+        value:
+        - $(params.test-commands)
+    params:
+    - name: image
+      value: $(params.test-image)@$(tasks.wait-for-test-image.results.digest)
+    - name: envs
+      value:
+      - $(params.test-envs[*])
+    runAfter:
+    - wait-for-test-image
+    taskRef:
+      name: test-cmd
+    when:
+    - input: $(params.test-image)
+      operator: notin
+      values:
+      - ""
+  - name: build-source-image
+    params:
+    - name: BINARY_IMAGE
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    - name: BINARY_IMAGE_DIGEST
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: source-build-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:b1eb49583b41872b27356fee20d5f0eb6ff7f5cdeacde7ffb39655f031104728
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(tasks.init.results.build)
+      operator: in
+      values:
+      - "true"
+    - input: $(params.build-source-image)
+      operator: in
+      values:
+      - "true"
+  - name: deprecated-base-image-check
+    params:
+    - name: IMAGE_URL
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: IMAGE_DIGEST
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: deprecated-image-check
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3c8b81fa868e27c6266e7660a4bfb4c822846dcf4304606e71e20893b0d3e515
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: clair-scan
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: clair-scan
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.2@sha256:417f44117f8d87a4a62fea6589b5746612ac61640b454dbd88f74892380411f2
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: ecosystem-cert-preflight-checks
+    params:
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: ecosystem-cert-preflight-checks
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:f99d2bdb02f13223d494077a2cde31418d09369f33c02134a8e7e5fad2f61eda
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: sast-snyk-check
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: sast-snyk-check-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:fe5e5ba3a72632cd505910de2eacd62c9d11ed570c325173188f8d568ac60771
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: clamav-scan
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: clamav-scan
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.2@sha256:7749146f7e4fe530846f1b15c9366178ec9f44776ef1922a60d3e7e2b8c6426b
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: sast-coverity-check
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: IMAGE
+      value: $(params.output-image)
+    - name: DOCKERFILE
+      value: $(params.dockerfile)
+    - name: CONTEXT
+      value: $(params.path-context)
+    - name: HERMETIC
+      value: $(params.hermetic)
+    - name: PREFETCH_INPUT
+      value: $(params.prefetch-input)
+    - name: IMAGE_EXPIRES_AFTER
+      value: $(params.image-expires-after)
+    - name: COMMIT_SHA
+      value: $(tasks.clone-repository.results.commit)
+    - name: BUILD_ARGS
+      value:
+      - $(params.build-args[*])
+    - name: BUILD_ARGS_FILE
+      value: $(params.build-args-file)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    runAfter:
+    - coverity-availability-check
+    taskRef:
+      params:
+      - name: name
+        value: sast-coverity-check-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.3@sha256:f9ca942208dc2e63b479384ccc56a611cc793397ecc837637b5b9f89c2ecbefe
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+    - input: $(tasks.coverity-availability-check.results.STATUS)
+      operator: in
+      values:
+      - success
+  - name: coverity-availability-check
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: coverity-availability-check
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:db2b267dc15e4ed17f704ee91b8e9b38068e1a35b1018a328fdca621819d74c6
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: sast-shell-check
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: sast-shell-check-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:bf7bdde00b7212f730c1356672290af6f38d070da2c8a316987b5c32fd49e0b9
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: sast-unicode-check
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: sast-unicode-check-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.3@sha256:a2bde66f6b4164620298c7d709b8f08515409404000fa1dc2260d2508b135651
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: apply-tags
+    params:
+    - name: IMAGE_URL
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: IMAGE_DIGEST
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: apply-tags
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.2@sha256:517a51e260c0b59654a9d7b842e1ab07d76bce15ca7ce9c8fd2489a19be6463d
+      - name: kind
+        value: task
+      resolver: bundles
+  - name: push-dockerfile
+    params:
+    - name: IMAGE
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: IMAGE_DIGEST
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: DOCKERFILE
+      value: $(params.dockerfile)
+    - name: CONTEXT
+      value: $(params.path-context)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: push-dockerfile-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:8c75c4a747e635e5f3e12266a3bb6e5d3132bf54e37eaa53d505f89897dd8eca
+      - name: kind
+        value: task
+      resolver: bundles
+  - name: rpms-signature-scan
+    params:
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: rpms-signature-scan
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:1b6c20ab3dbfb0972803d3ebcb2fa72642e59400c77bd66dfd82028bdd09e120
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  finally:
+  - name: show-sbom
+    params:
+    - name: IMAGE_URL
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    taskRef:
+      params:
+      - name: name
+        value: show-sbom
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:86c069cac0a669797e8049faa8aa4088e70ff7fcd579d5bdc37626a9e0488a05
+      - name: kind
+        value: task
+      resolver: bundles
+  workspaces:
+  - name: git-auth
+    optional: true
+  - name: netrc
+    optional: true

.tekton/pipelines/push-pipeline.yaml

@@ -0,0 +1,640 @@
+apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: push-pipeline
+  labels:
+    appstudio.openshift.io/application: ramalama
+spec:
+  description: |
+    Pipeline for building RamaLama images on push.
+    Based on the [docker-build-multi-platform-oci-ta](https://github.com/konflux-ci/build-definitions/tree/main/pipelines/docker-build-multi-platform-oci-ta) pipeline from [Konflux](https://konflux-ci.dev/).
+  params:
+  - description: Source Repository URL
+    name: git-url
+    type: string
+  - default: ""
+    description: Revision of the Source Repository
+    name: revision
+    type: string
+  - description: Fully Qualified Output Image
+    name: output-image
+    type: string
+  - default: .
+    description: Path to the source code of an application's component from where to build image.
+    name: path-context
+    type: string
+  - default: Dockerfile
+    description: Path to the Dockerfile inside the context specified by parameter path-context
+    name: dockerfile
+    type: string
+  - default: "false"
+    description: Force rebuild image
+    name: rebuild
+    type: string
+  - default: "false"
+    description: Skip checks against built image
+    name: skip-checks
+    type: string
+  - default: "false"
+    description: Execute the build with network isolation
+    name: hermetic
+    type: string
+  - default: ""
+    description: Build dependencies to be prefetched by Cachi2
+    name: prefetch-input
+    type: string
+  - default: ""
+    description: Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.
+    name: image-expires-after
+  - default: "false"
+    description: Build a source image.
+    name: build-source-image
+    type: string
+  - default: "true"
+    description: Add built image into an OCI image index
+    name: build-image-index
+    type: string
+  - default: []
+    description: Array of --build-arg values ("arg=value" strings) for buildah
+    name: build-args
+    type: array
+  - default: ""
+    description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file
+    name: build-args-file
+    type: string
+  - default: "false"
+    description: Whether to enable privileged mode, should be used only with remote VMs
+    name: privileged-nested
+    type: string
+  - default:
+    - linux-c4xlarge/amd64
+    description: List of platforms to build the container images on. The available set of values is determined by the configuration of the multi-platform-controller.
+    name: build-platforms
+    type: array
+  - default: ""
+    description: The parent image of the image being built.
+    name: parent-image
+  - default: ""
+    description: The image to use for running tests.
+    name: test-image
+  - default: []
+    description: List of environment variables (NAME=VALUE) to be set in the test environment.
+    name: test-envs
+    type: array
+  - default:
+    - echo "No tests defined"
+    description: List of test commands to run after the image is built.
+    name: test-commands
+    type: array
+  results:
+  - description: ""
+    name: IMAGE_URL
+    value: $(tasks.build-image-index.results.IMAGE_URL)
+  - description: ""
+    name: IMAGE_DIGEST
+    value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+  - description: ""
+    name: CHAINS-GIT_URL
+    value: $(tasks.clone-repository.results.url)
+  - description: ""
+    name: CHAINS-GIT_COMMIT
+    value: $(tasks.clone-repository.results.commit)
+  tasks:
+  - name: init
+    params:
+    - name: image-url
+      value: $(params.output-image)
+    - name: rebuild
+      value: $(params.rebuild)
+    - name: skip-checks
+      value: $(params.skip-checks)
+    taskRef:
+      params:
+      - name: name
+        value: init
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:1d8221c84f91b923d89de50bf16481ea729e3b68ea04a9a7cbe8485ddbb27ee6
+      - name: kind
+        value: task
+      resolver: bundles
+  - name: clone-repository
+    params:
+    - name: url
+      value: $(params.git-url)
+    - name: revision
+      value: $(params.revision)
+    - name: ociStorage
+      value: $(params.output-image).git
+    - name: ociArtifactExpiresAfter
+      value: $(params.image-expires-after)
+    runAfter:
+    - init
+    taskRef:
+      params:
+      - name: name
+        value: git-clone-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:d35e5d501cb5f5f88369511f76249857cb5ac30250e1dcf086939321964ff6b9
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(tasks.init.results.build)
+      operator: in
+      values:
+      - "true"
+    workspaces:
+    - name: basic-auth
+      workspace: git-auth
+  - name: prefetch-dependencies
+    params:
+    - name: input
+      value: $(params.prefetch-input)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
+    - name: ociStorage
+      value: $(params.output-image).prefetch
+    - name: ociArtifactExpiresAfter
+      value: $(params.image-expires-after)
+    runAfter:
+    - clone-repository
+    taskRef:
+      params:
+      - name: name
+        value: prefetch-dependencies-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.2@sha256:092491ac0f6e1009d10c58a1319d1029371bf637cc1293cceba53c6da5314ed1
+      - name: kind
+        value: task
+      resolver: bundles
+    workspaces:
+    - name: git-basic-auth
+      workspace: git-auth
+    - name: netrc
+      workspace: netrc
+  - name: wait-for-parent-image
+    params:
+    - name: ref
+      value: $(params.parent-image)
+    taskRef:
+      name: wait-for-image
+    when:
+    - input: $(params.parent-image)
+      operator: notin
+      values:
+      - ""
+  - matrix:
+      params:
+      - name: PLATFORM
+        value:
+        - $(params.build-platforms)
+    name: build-images
+    params:
+    - name: IMAGE
+      value: $(params.output-image)
+    - name: DOCKERFILE
+      value: $(params.dockerfile)
+    - name: CONTEXT
+      value: $(params.path-context)
+    - name: HERMETIC
+      value: $(params.hermetic)
+    - name: PREFETCH_INPUT
+      value: $(params.prefetch-input)
+    - name: IMAGE_EXPIRES_AFTER
+      value: $(params.image-expires-after)
+    - name: COMMIT_SHA
+      value: $(tasks.clone-repository.results.commit)
+    - name: BUILD_ARGS
+      value:
+      - $(params.build-args[*])
+    - name: BUILD_ARGS_FILE
+      value: $(params.build-args-file)
+    - name: PRIVILEGED_NESTED
+      value: $(params.privileged-nested)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    - name: IMAGE_APPEND_PLATFORM
+      value: "true"
+    runAfter:
+    - wait-for-parent-image
+    - prefetch-dependencies
+    taskRef:
+      params:
+      - name: name
+        value: buildah-remote-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.4@sha256:9e866d4d0489a6ab84ae263db416c9f86d2d6117ef4444f495a0e97388ae3ac0
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(tasks.init.results.build)
+      operator: in
+      values:
+      - "true"
+  - name: build-image-index
+    params:
+    - name: IMAGE
+      value: $(params.output-image)
+    - name: COMMIT_SHA
+      value: $(tasks.clone-repository.results.commit)
+    - name: IMAGE_EXPIRES_AFTER
+      value: $(params.image-expires-after)
+    - name: ALWAYS_BUILD_INDEX
+      value: $(params.build-image-index)
+    - name: IMAGES
+      value:
+      - $(tasks.build-images.results.IMAGE_REF[*])
+    runAfter:
+    - build-images
+    taskRef:
+      params:
+      - name: name
+        value: build-image-index
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:3499772af90aad0d3935629be6d37dd9292195fb629e6f43ec839c7f545a0faa
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(tasks.init.results.build)
+      operator: in
+      values:
+      - "true"
+  - name: wait-for-test-image
+    params:
+    - name: ref
+      value: $(params.test-image)
+    runAfter:
+    - build-image-index
+    taskRef:
+      name: wait-for-image
+    when:
+    - input: $(params.test-image)
+      operator: notin
+      values:
+      - ""
+  - name: run-tests
+    matrix:
+      params:
+      - name: cmd
+        value:
+        - $(params.test-commands)
+    params:
+    - name: image
+      value: $(params.test-image)@$(tasks.wait-for-test-image.results.digest)
+    - name: envs
+      value:
+      - $(params.test-envs[*])
+    runAfter:
+    - wait-for-test-image
+    taskRef:
+      name: test-cmd
+    when:
+    - input: $(params.test-image)
+      operator: notin
+      values:
+      - ""
+  - name: build-source-image
+    params:
+    - name: BINARY_IMAGE
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    - name: BINARY_IMAGE_DIGEST
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: source-build-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:b1eb49583b41872b27356fee20d5f0eb6ff7f5cdeacde7ffb39655f031104728
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(tasks.init.results.build)
+      operator: in
+      values:
+      - "true"
+    - input: $(params.build-source-image)
+      operator: in
+      values:
+      - "true"
+  - name: deprecated-base-image-check
+    params:
+    - name: IMAGE_URL
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: IMAGE_DIGEST
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: deprecated-image-check
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3c8b81fa868e27c6266e7660a4bfb4c822846dcf4304606e71e20893b0d3e515
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: clair-scan
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: clair-scan
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.2@sha256:417f44117f8d87a4a62fea6589b5746612ac61640b454dbd88f74892380411f2
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: ecosystem-cert-preflight-checks
+    params:
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: ecosystem-cert-preflight-checks
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:f99d2bdb02f13223d494077a2cde31418d09369f33c02134a8e7e5fad2f61eda
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: sast-snyk-check
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: sast-snyk-check-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:fe5e5ba3a72632cd505910de2eacd62c9d11ed570c325173188f8d568ac60771
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: clamav-scan
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: clamav-scan
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.2@sha256:7749146f7e4fe530846f1b15c9366178ec9f44776ef1922a60d3e7e2b8c6426b
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: sast-coverity-check
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: IMAGE
+      value: $(params.output-image)
+    - name: DOCKERFILE
+      value: $(params.dockerfile)
+    - name: CONTEXT
+      value: $(params.path-context)
+    - name: HERMETIC
+      value: $(params.hermetic)
+    - name: PREFETCH_INPUT
+      value: $(params.prefetch-input)
+    - name: IMAGE_EXPIRES_AFTER
+      value: $(params.image-expires-after)
+    - name: COMMIT_SHA
+      value: $(tasks.clone-repository.results.commit)
+    - name: BUILD_ARGS
+      value:
+      - $(params.build-args[*])
+    - name: BUILD_ARGS_FILE
+      value: $(params.build-args-file)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    runAfter:
+    - coverity-availability-check
+    taskRef:
+      params:
+      - name: name
+        value: sast-coverity-check-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.3@sha256:f9ca942208dc2e63b479384ccc56a611cc793397ecc837637b5b9f89c2ecbefe
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+    - input: $(tasks.coverity-availability-check.results.STATUS)
+      operator: in
+      values:
+      - success
+  - name: coverity-availability-check
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: coverity-availability-check
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:db2b267dc15e4ed17f704ee91b8e9b38068e1a35b1018a328fdca621819d74c6
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: sast-shell-check
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: sast-shell-check-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:bf7bdde00b7212f730c1356672290af6f38d070da2c8a316987b5c32fd49e0b9
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: sast-unicode-check
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    - name: CACHI2_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: sast-unicode-check-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.3@sha256:a2bde66f6b4164620298c7d709b8f08515409404000fa1dc2260d2508b135651
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  - name: apply-tags
+    params:
+    - name: IMAGE_URL
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: IMAGE_DIGEST
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: apply-tags
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.2@sha256:517a51e260c0b59654a9d7b842e1ab07d76bce15ca7ce9c8fd2489a19be6463d
+      - name: kind
+        value: task
+      resolver: bundles
+  - name: push-dockerfile
+    params:
+    - name: IMAGE
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: IMAGE_DIGEST
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: DOCKERFILE
+      value: $(params.dockerfile)
+    - name: CONTEXT
+      value: $(params.path-context)
+    - name: SOURCE_ARTIFACT
+      value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: push-dockerfile-oci-ta
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:8c75c4a747e635e5f3e12266a3bb6e5d3132bf54e37eaa53d505f89897dd8eca
+      - name: kind
+        value: task
+      resolver: bundles
+  - name: rpms-signature-scan
+    params:
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    runAfter:
+    - build-image-index
+    taskRef:
+      params:
+      - name: name
+        value: rpms-signature-scan
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:1b6c20ab3dbfb0972803d3ebcb2fa72642e59400c77bd66dfd82028bdd09e120
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values:
+      - "false"
+  finally:
+  - name: show-sbom
+    params:
+    - name: IMAGE_URL
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    taskRef:
+      params:
+      - name: name
+        value: show-sbom
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:86c069cac0a669797e8049faa8aa4088e70ff7fcd579d5bdc37626a9e0488a05
+      - name: kind
+        value: task
+      resolver: bundles
+  workspaces:
+  - name: git-auth
+    optional: true
+  - name: netrc
+    optional: true

.tekton/ramalama-cli/ramalama-cli-pull-request.yaml

@@ -0,0 +1,42 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: ramalama-cli
+    pipelines.appstudio.openshift.io/type: build
+  name: ramalama-cli-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama-cli:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/ramalama-cli/Containerfile
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/ramalama-cli/ramalama-cli-push.yaml

@@ -0,0 +1,39 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: ramalama-cli
+    pipelines.appstudio.openshift.io/type: build
+  name: ramalama-cli-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama-cli:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/ramalama-cli/Containerfile
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/ramalama-llama-server/ramalama-llama-server-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: ramalama-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: ramalama-llama-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama-llama-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/ramalama:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/ramalama-llama-server/ramalama-llama-server-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: ramalama-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: ramalama-llama-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama-llama-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/ramalama:{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/ramalama-pull-request.yaml

@@ -1,592 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: PipelineRun
-metadata:
-  annotations:
-    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
-    build.appstudio.redhat.com/commit_sha: '{{revision}}'
-    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
-    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/cancel-in-progress: "true"
-    pipelinesascode.tekton.dev/max-keep-runs: "3"
-    pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch
-      == "main" && ( "container-images/ramalama/***".pathChanged() || ".tekton/ramalama-pull-request.yaml".pathChanged()
-      )
-  creationTimestamp: null
-  labels:
-    appstudio.openshift.io/application: ramalama
-    appstudio.openshift.io/component: ramalama
-    pipelines.appstudio.openshift.io/type: build
-  name: ramalama-on-pull-request
-  namespace: ramalama-konflux-tenant
-spec:
-  params:
-  - name: git-url
-    value: '{{source_url}}'
-  - name: revision
-    value: '{{revision}}'
-  - name: output-image
-    value: quay.io/redhat-user-workloads/ramalama-konflux-tenant/ramalama/ramalama:on-pr-{{revision}}
-  - name: image-expires-after
-    value: 5d
-  - name: dockerfile
-    value: Containerfile
-  - name: path-context
-    value: container-images/ramalama
-  pipelineSpec:
-    description: |
-      This pipeline is ideal for building container images from a Containerfile while maintaining trust after pipeline customization.
-
-      _Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://enterprisecontract.dev/docs/ec-policies/release_policy.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks.
-      This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_
-    finally:
-    - name: show-sbom
-      params:
-      - name: IMAGE_URL
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      taskRef:
-        params:
-        - name: name
-          value: show-sbom
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:04f15cbce548e1db7770eee3f155ccb2cc0140a6c371dc67e9a34d83673ea0c0
-        - name: kind
-          value: task
-        resolver: bundles
-    params:
-    - description: Source Repository URL
-      name: git-url
-      type: string
-    - default: ""
-      description: Revision of the Source Repository
-      name: revision
-      type: string
-    - description: Fully Qualified Output Image
-      name: output-image
-      type: string
-    - default: .
-      description: Path to the source code of an application's component from where
-        to build image.
-      name: path-context
-      type: string
-    - default: Dockerfile
-      description: Path to the Dockerfile inside the context specified by parameter
-        path-context
-      name: dockerfile
-      type: string
-    - default: "false"
-      description: Force rebuild image
-      name: rebuild
-      type: string
-    - default: "false"
-      description: Skip checks against built image
-      name: skip-checks
-      type: string
-    - default: "false"
-      description: Execute the build with network isolation
-      name: hermetic
-      type: string
-    - default: ""
-      description: Build dependencies to be prefetched by Cachi2
-      name: prefetch-input
-      type: string
-    - default: ""
-      description: Image tag expiration time, time values could be something like
-        1h, 2d, 3w for hours, days, and weeks, respectively.
-      name: image-expires-after
-    - default: "false"
-      description: Build a source image.
-      name: build-source-image
-      type: string
-    - default: "false"
-      description: Add built image into an OCI image index
-      name: build-image-index
-      type: string
-    - default: []
-      description: Array of --build-arg values ("arg=value" strings) for buildah
-      name: build-args
-      type: array
-    - default: ""
-      description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file
-      name: build-args-file
-      type: string
-    results:
-    - description: ""
-      name: IMAGE_URL
-      value: $(tasks.build-image-index.results.IMAGE_URL)
-    - description: ""
-      name: IMAGE_DIGEST
-      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-    - description: ""
-      name: CHAINS-GIT_URL
-      value: $(tasks.clone-repository.results.url)
-    - description: ""
-      name: CHAINS-GIT_COMMIT
-      value: $(tasks.clone-repository.results.commit)
-    tasks:
-    - name: init
-      params:
-      - name: image-url
-        value: $(params.output-image)
-      - name: rebuild
-        value: $(params.rebuild)
-      - name: skip-checks
-        value: $(params.skip-checks)
-      taskRef:
-        params:
-        - name: name
-          value: init
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:2f59e9a3c20ce4509356389d327087213cc82c079b30811935837791da140f9f
-        - name: kind
-          value: task
-        resolver: bundles
-    - name: clone-repository
-      params:
-      - name: url
-        value: $(params.git-url)
-      - name: revision
-        value: $(params.revision)
-      - name: ociStorage
-        value: $(params.output-image).git
-      - name: ociArtifactExpiresAfter
-        value: $(params.image-expires-after)
-      runAfter:
-      - init
-      taskRef:
-        params:
-        - name: name
-          value: git-clone-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:3e171c1f3a9487a5764ebef629f93b3d2fc01cc8bad382dd8065cdfe42214148
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(tasks.init.results.build)
-        operator: in
-        values:
-        - "true"
-      workspaces:
-      - name: basic-auth
-        workspace: git-auth
-    - name: prefetch-dependencies
-      params:
-      - name: input
-        value: $(params.prefetch-input)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
-      - name: ociStorage
-        value: $(params.output-image).prefetch
-      - name: ociArtifactExpiresAfter
-        value: $(params.image-expires-after)
-      runAfter:
-      - clone-repository
-      taskRef:
-        params:
-        - name: name
-          value: prefetch-dependencies-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.2@sha256:8398b3332f911b5b5244f8429adae4ec2982e7fb7ab8eecdc4e05a9fb05f60fd
-        - name: kind
-          value: task
-        resolver: bundles
-      workspaces:
-      - name: git-basic-auth
-        workspace: git-auth
-      - name: netrc
-        workspace: netrc
-    - name: build-container
-      params:
-      - name: IMAGE
-        value: $(params.output-image)
-      - name: DOCKERFILE
-        value: $(params.dockerfile)
-      - name: CONTEXT
-        value: $(params.path-context)
-      - name: HERMETIC
-        value: $(params.hermetic)
-      - name: PREFETCH_INPUT
-        value: $(params.prefetch-input)
-      - name: IMAGE_EXPIRES_AFTER
-        value: $(params.image-expires-after)
-      - name: COMMIT_SHA
-        value: $(tasks.clone-repository.results.commit)
-      - name: BUILD_ARGS
-        value:
-        - $(params.build-args[*])
-      - name: BUILD_ARGS_FILE
-        value: $(params.build-args-file)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - prefetch-dependencies
-      taskRef:
-        params:
-        - name: name
-          value: buildah-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.4@sha256:204db46550475127bd943ed243b560628d645568eb1f6b19a5c1e88cd697182d
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(tasks.init.results.build)
-        operator: in
-        values:
-        - "true"
-    - name: build-image-index
-      params:
-      - name: IMAGE
-        value: $(params.output-image)
-      - name: COMMIT_SHA
-        value: $(tasks.clone-repository.results.commit)
-      - name: IMAGE_EXPIRES_AFTER
-        value: $(params.image-expires-after)
-      - name: ALWAYS_BUILD_INDEX
-        value: $(params.build-image-index)
-      - name: IMAGES
-        value:
-        - $(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST)
-      runAfter:
-      - build-container
-      taskRef:
-        params:
-        - name: name
-          value: build-image-index
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:d34e4245b767c5b1b5edbbad9fc9cf8050cf19a69c8e55856479848405c596ec
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(tasks.init.results.build)
-        operator: in
-        values:
-        - "true"
-    - name: build-source-image
-      params:
-      - name: BINARY_IMAGE
-        value: $(params.output-image)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: source-build-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.2@sha256:66401e328c0036012112caad2ba02617954330689c9c590e9f53cad0256bb5ec
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(tasks.init.results.build)
-        operator: in
-        values:
-        - "true"
-      - input: $(params.build-source-image)
-        operator: in
-        values:
-        - "true"
-    - name: deprecated-base-image-check
-      params:
-      - name: IMAGE_URL
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: IMAGE_DIGEST
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: deprecated-image-check
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:5d63b920b71192906fe4d6c4903f594e6f34c5edcff9d21714a08b5edcfbc667
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: clair-scan
-      params:
-      - name: image-digest
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: clair-scan
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.2@sha256:03383b5a8674edef0ae184dd81f00386017624a5af255cb0b5803d7659483ba5
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: ecosystem-cert-preflight-checks
-      params:
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: ecosystem-cert-preflight-checks
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.1@sha256:df8a25a3431a70544172ed4844f9d0c6229d39130633960729f825a031a7dea9
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: sast-snyk-check
-      params:
-      - name: image-digest
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: sast-snyk-check-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.3@sha256:ba2c9c37a287a8220d8810c31211fc7c33f9b1576bcf5cacf2f050824624c9fd
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: clamav-scan
-      params:
-      - name: image-digest
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: clamav-scan
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.2@sha256:c30c12681b02eb4b83aeb4021d0e714a72db4d1d3bb14579652f4d1a763473ab
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: sast-coverity-check
-      params:
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: IMAGE
-        value: $(params.output-image)
-      - name: DOCKERFILE
-        value: $(params.dockerfile)
-      - name: CONTEXT
-        value: $(params.path-context)
-      - name: HERMETIC
-        value: $(params.hermetic)
-      - name: PREFETCH_INPUT
-        value: $(params.prefetch-input)
-      - name: IMAGE_EXPIRES_AFTER
-        value: $(params.image-expires-after)
-      - name: COMMIT_SHA
-        value: $(tasks.clone-repository.results.commit)
-      - name: BUILD_ARGS
-        value:
-        - $(params.build-args[*])
-      - name: BUILD_ARGS_FILE
-        value: $(params.build-args-file)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - coverity-availability-check
-      taskRef:
-        params:
-        - name: name
-          value: sast-coverity-check-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.2@sha256:b874e49385d8bdc27dfe273a4ec466f8b2a5b0076c64cef5e86b29ee7ca7c6f2
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-      - input: $(tasks.coverity-availability-check.results.STATUS)
-        operator: in
-        values:
-        - success
-    - name: coverity-availability-check
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: coverity-availability-check
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:0b35292eed661c5e3ca307c0ba7f594d17555db2a1da567903b0b47697fa23ed
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: sast-shell-check
-      params:
-      - name: image-digest
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: sast-shell-check-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:371ba9d9f08c55c58e0c76d696644557b92ebff4c8f71facca3a81e0b92bb4f4
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: sast-unicode-check
-      params:
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: sast-unicode-check-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.1@sha256:7ff6753af9bc30b1f1ae982abe174ee50d2467e3e33a8618fd858c64dea6167b
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: apply-tags
-      params:
-      - name: IMAGE
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: apply-tags
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.1@sha256:e1d365ce85d6448f6ebd0d0a000d0f45b694950b7545a2c34bfbcf992c80df61
-        - name: kind
-          value: task
-        resolver: bundles
-    - name: push-dockerfile
-      params:
-      - name: IMAGE
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: IMAGE_DIGEST
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      - name: DOCKERFILE
-        value: $(params.dockerfile)
-      - name: CONTEXT
-        value: $(params.path-context)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: push-dockerfile-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:7647ce9715c23e78a33663b88febe37279099c03f5a96191d0ce1aa4bfc9aa7b
-        - name: kind
-          value: task
-        resolver: bundles
-    - name: rpms-signature-scan
-      params:
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: image-digest
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: rpms-signature-scan
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:d00d159c370e3c99447516970c316ef57dfd27c29e0ce3cff50727c9c40936d8
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    workspaces:
-    - name: git-auth
-      optional: true
-    - name: netrc
-      optional: true
-  taskRunTemplate: {}
-  workspaces:
-  - name: git-auth
-    secret:
-      secretName: '{{ git_auth_secret }}'
-status: {}

.tekton/ramalama-push.yaml

@@ -1,588 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: PipelineRun
-metadata:
-  annotations:
-    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
-    build.appstudio.redhat.com/commit_sha: '{{revision}}'
-    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/cancel-in-progress: "false"
-    pipelinesascode.tekton.dev/max-keep-runs: "3"
-    pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch
-      == "main"
-  creationTimestamp: null
-  labels:
-    appstudio.openshift.io/application: ramalama
-    appstudio.openshift.io/component: ramalama
-    pipelines.appstudio.openshift.io/type: build
-  name: ramalama-on-push
-  namespace: ramalama-konflux-tenant
-spec:
-  params:
-  - name: git-url
-    value: '{{source_url}}'
-  - name: revision
-    value: '{{revision}}'
-  - name: output-image
-    value: quay.io/redhat-user-workloads/ramalama-konflux-tenant/ramalama/ramalama:{{revision}}
-  - name: dockerfile
-    value: Containerfile
-  - name: path-context
-    value: container-images/ramalama
-  pipelineSpec:
-    description: |
-      This pipeline is ideal for building container images from a Containerfile while maintaining trust after pipeline customization.
-
-      _Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://enterprisecontract.dev/docs/ec-policies/release_policy.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks.
-      This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_
-    finally:
-    - name: show-sbom
-      params:
-      - name: IMAGE_URL
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      taskRef:
-        params:
-        - name: name
-          value: show-sbom
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:04f15cbce548e1db7770eee3f155ccb2cc0140a6c371dc67e9a34d83673ea0c0
-        - name: kind
-          value: task
-        resolver: bundles
-    params:
-    - description: Source Repository URL
-      name: git-url
-      type: string
-    - default: ""
-      description: Revision of the Source Repository
-      name: revision
-      type: string
-    - description: Fully Qualified Output Image
-      name: output-image
-      type: string
-    - default: .
-      description: Path to the source code of an application's component from where
-        to build image.
-      name: path-context
-      type: string
-    - default: Dockerfile
-      description: Path to the Dockerfile inside the context specified by parameter
-        path-context
-      name: dockerfile
-      type: string
-    - default: "false"
-      description: Force rebuild image
-      name: rebuild
-      type: string
-    - default: "false"
-      description: Skip checks against built image
-      name: skip-checks
-      type: string
-    - default: "false"
-      description: Execute the build with network isolation
-      name: hermetic
-      type: string
-    - default: ""
-      description: Build dependencies to be prefetched by Cachi2
-      name: prefetch-input
-      type: string
-    - default: ""
-      description: Image tag expiration time, time values could be something like
-        1h, 2d, 3w for hours, days, and weeks, respectively.
-      name: image-expires-after
-    - default: "false"
-      description: Build a source image.
-      name: build-source-image
-      type: string
-    - default: "false"
-      description: Add built image into an OCI image index
-      name: build-image-index
-      type: string
-    - default: []
-      description: Array of --build-arg values ("arg=value" strings) for buildah
-      name: build-args
-      type: array
-    - default: ""
-      description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file
-      name: build-args-file
-      type: string
-    results:
-    - description: ""
-      name: IMAGE_URL
-      value: $(tasks.build-image-index.results.IMAGE_URL)
-    - description: ""
-      name: IMAGE_DIGEST
-      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-    - description: ""
-      name: CHAINS-GIT_URL
-      value: $(tasks.clone-repository.results.url)
-    - description: ""
-      name: CHAINS-GIT_COMMIT
-      value: $(tasks.clone-repository.results.commit)
-    tasks:
-    - name: init
-      params:
-      - name: image-url
-        value: $(params.output-image)
-      - name: rebuild
-        value: $(params.rebuild)
-      - name: skip-checks
-        value: $(params.skip-checks)
-      taskRef:
-        params:
-        - name: name
-          value: init
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:2f59e9a3c20ce4509356389d327087213cc82c079b30811935837791da140f9f
-        - name: kind
-          value: task
-        resolver: bundles
-    - name: clone-repository
-      params:
-      - name: url
-        value: $(params.git-url)
-      - name: revision
-        value: $(params.revision)
-      - name: ociStorage
-        value: $(params.output-image).git
-      - name: ociArtifactExpiresAfter
-        value: $(params.image-expires-after)
-      runAfter:
-      - init
-      taskRef:
-        params:
-        - name: name
-          value: git-clone-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:3e171c1f3a9487a5764ebef629f93b3d2fc01cc8bad382dd8065cdfe42214148
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(tasks.init.results.build)
-        operator: in
-        values:
-        - "true"
-      workspaces:
-      - name: basic-auth
-        workspace: git-auth
-    - name: prefetch-dependencies
-      params:
-      - name: input
-        value: $(params.prefetch-input)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
-      - name: ociStorage
-        value: $(params.output-image).prefetch
-      - name: ociArtifactExpiresAfter
-        value: $(params.image-expires-after)
-      runAfter:
-      - clone-repository
-      taskRef:
-        params:
-        - name: name
-          value: prefetch-dependencies-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.2@sha256:8398b3332f911b5b5244f8429adae4ec2982e7fb7ab8eecdc4e05a9fb05f60fd
-        - name: kind
-          value: task
-        resolver: bundles
-      workspaces:
-      - name: git-basic-auth
-        workspace: git-auth
-      - name: netrc
-        workspace: netrc
-    - name: build-container
-      params:
-      - name: IMAGE
-        value: $(params.output-image)
-      - name: DOCKERFILE
-        value: $(params.dockerfile)
-      - name: CONTEXT
-        value: $(params.path-context)
-      - name: HERMETIC
-        value: $(params.hermetic)
-      - name: PREFETCH_INPUT
-        value: $(params.prefetch-input)
-      - name: IMAGE_EXPIRES_AFTER
-        value: $(params.image-expires-after)
-      - name: COMMIT_SHA
-        value: $(tasks.clone-repository.results.commit)
-      - name: BUILD_ARGS
-        value:
-        - $(params.build-args[*])
-      - name: BUILD_ARGS_FILE
-        value: $(params.build-args-file)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - prefetch-dependencies
-      taskRef:
-        params:
-        - name: name
-          value: buildah-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.4@sha256:204db46550475127bd943ed243b560628d645568eb1f6b19a5c1e88cd697182d
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(tasks.init.results.build)
-        operator: in
-        values:
-        - "true"
-    - name: build-image-index
-      params:
-      - name: IMAGE
-        value: $(params.output-image)
-      - name: COMMIT_SHA
-        value: $(tasks.clone-repository.results.commit)
-      - name: IMAGE_EXPIRES_AFTER
-        value: $(params.image-expires-after)
-      - name: ALWAYS_BUILD_INDEX
-        value: $(params.build-image-index)
-      - name: IMAGES
-        value:
-        - $(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST)
-      runAfter:
-      - build-container
-      taskRef:
-        params:
-        - name: name
-          value: build-image-index
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:d34e4245b767c5b1b5edbbad9fc9cf8050cf19a69c8e55856479848405c596ec
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(tasks.init.results.build)
-        operator: in
-        values:
-        - "true"
-    - name: build-source-image
-      params:
-      - name: BINARY_IMAGE
-        value: $(params.output-image)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: source-build-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.2@sha256:66401e328c0036012112caad2ba02617954330689c9c590e9f53cad0256bb5ec
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(tasks.init.results.build)
-        operator: in
-        values:
-        - "true"
-      - input: $(params.build-source-image)
-        operator: in
-        values:
-        - "true"
-    - name: deprecated-base-image-check
-      params:
-      - name: IMAGE_URL
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: IMAGE_DIGEST
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: deprecated-image-check
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:5d63b920b71192906fe4d6c4903f594e6f34c5edcff9d21714a08b5edcfbc667
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: clair-scan
-      params:
-      - name: image-digest
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: clair-scan
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.2@sha256:03383b5a8674edef0ae184dd81f00386017624a5af255cb0b5803d7659483ba5
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: ecosystem-cert-preflight-checks
-      params:
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: ecosystem-cert-preflight-checks
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.1@sha256:df8a25a3431a70544172ed4844f9d0c6229d39130633960729f825a031a7dea9
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: sast-snyk-check
-      params:
-      - name: image-digest
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: sast-snyk-check-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.3@sha256:ba2c9c37a287a8220d8810c31211fc7c33f9b1576bcf5cacf2f050824624c9fd
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: clamav-scan
-      params:
-      - name: image-digest
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: clamav-scan
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.2@sha256:c30c12681b02eb4b83aeb4021d0e714a72db4d1d3bb14579652f4d1a763473ab
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: sast-coverity-check
-      params:
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: IMAGE
-        value: $(params.output-image)
-      - name: DOCKERFILE
-        value: $(params.dockerfile)
-      - name: CONTEXT
-        value: $(params.path-context)
-      - name: HERMETIC
-        value: $(params.hermetic)
-      - name: PREFETCH_INPUT
-        value: $(params.prefetch-input)
-      - name: IMAGE_EXPIRES_AFTER
-        value: $(params.image-expires-after)
-      - name: COMMIT_SHA
-        value: $(tasks.clone-repository.results.commit)
-      - name: BUILD_ARGS
-        value:
-        - $(params.build-args[*])
-      - name: BUILD_ARGS_FILE
-        value: $(params.build-args-file)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - coverity-availability-check
-      taskRef:
-        params:
-        - name: name
-          value: sast-coverity-check-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.2@sha256:b874e49385d8bdc27dfe273a4ec466f8b2a5b0076c64cef5e86b29ee7ca7c6f2
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-      - input: $(tasks.coverity-availability-check.results.STATUS)
-        operator: in
-        values:
-        - success
-    - name: coverity-availability-check
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: coverity-availability-check
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:0b35292eed661c5e3ca307c0ba7f594d17555db2a1da567903b0b47697fa23ed
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: sast-shell-check
-      params:
-      - name: image-digest
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: sast-shell-check-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:371ba9d9f08c55c58e0c76d696644557b92ebff4c8f71facca3a81e0b92bb4f4
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: sast-unicode-check
-      params:
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      - name: CACHI2_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: sast-unicode-check-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.1@sha256:7ff6753af9bc30b1f1ae982abe174ee50d2467e3e33a8618fd858c64dea6167b
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    - name: apply-tags
-      params:
-      - name: IMAGE
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: apply-tags
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.1@sha256:e1d365ce85d6448f6ebd0d0a000d0f45b694950b7545a2c34bfbcf992c80df61
-        - name: kind
-          value: task
-        resolver: bundles
-    - name: push-dockerfile
-      params:
-      - name: IMAGE
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: IMAGE_DIGEST
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      - name: DOCKERFILE
-        value: $(params.dockerfile)
-      - name: CONTEXT
-        value: $(params.path-context)
-      - name: SOURCE_ARTIFACT
-        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: push-dockerfile-oci-ta
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:7647ce9715c23e78a33663b88febe37279099c03f5a96191d0ce1aa4bfc9aa7b
-        - name: kind
-          value: task
-        resolver: bundles
-    - name: rpms-signature-scan
-      params:
-      - name: image-url
-        value: $(tasks.build-image-index.results.IMAGE_URL)
-      - name: image-digest
-        value: $(tasks.build-image-index.results.IMAGE_DIGEST)
-      runAfter:
-      - build-image-index
-      taskRef:
-        params:
-        - name: name
-          value: rpms-signature-scan
-        - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:d00d159c370e3c99447516970c316ef57dfd27c29e0ce3cff50727c9c40936d8
-        - name: kind
-          value: task
-        resolver: bundles
-      when:
-      - input: $(params.skip-checks)
-        operator: in
-        values:
-        - "false"
-    workspaces:
-    - name: git-auth
-      optional: true
-    - name: netrc
-      optional: true
-  taskRunTemplate: {}
-  workspaces:
-  - name: git-auth
-    secret:
-      secretName: '{{ git_auth_secret }}'
-status: {}

.tekton/ramalama-rag/ramalama-rag-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: ramalama-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: ramalama-rag-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama-rag:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+    - linux-d160-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/ramalama:on-pr-{{revision}}
+    - GPU=cpu
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/ramalama-rag/ramalama-rag-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: ramalama-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: ramalama-rag-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama-rag:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+    - linux-d160-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/ramalama:{{revision}}
+    - GPU=cpu
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/ramalama-whisper-server/ramalama-whisper-server-pull-request.yaml

@@ -0,0 +1,48 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: ramalama-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: ramalama-whisper-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama-whisper-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/ramalama:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/ramalama-whisper-server/ramalama-whisper-server-push.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: ramalama-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: ramalama-whisper-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama-whisper-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+    - linux-m2xlarge/arm64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/ramalama:{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/ramalama/ramalama-pull-request.yaml

@@ -0,0 +1,52 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: ramalama
+    pipelines.appstudio.openshift.io/type: build
+  name: ramalama-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/ramalama/Containerfile
+  - name: test-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/bats:on-pr-{{revision}}
+  - name: test-envs
+    value:
+    - RAMALAMA_IMAGE=quay.io/redhat-user-workloads/ramalama-tenant/ramalama:on-pr-{{revision}}
+  - name: test-commands
+    value:
+    - make validate
+    - make unit-tests
+    - make cov-tests
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/ramalama/ramalama-push.yaml

@@ -0,0 +1,49 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: ramalama
+    pipelines.appstudio.openshift.io/type: build
+  name: ramalama-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/ramalama:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-c4xlarge/amd64
+    - linux-c4xlarge/arm64
+  - name: dockerfile
+    value: container-images/ramalama/Containerfile
+  - name: test-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/bats:{{revision}}
+  - name: test-envs
+    value:
+    - RAMALAMA_IMAGE=quay.io/redhat-user-workloads/ramalama-tenant/ramalama:{{revision}}
+  - name: test-commands
+    value:
+    - make validate
+    - make unit-tests
+    - make cov-tests
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-llama-server/rocm-llama-server-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-llama-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-llama-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-llama-server/rocm-llama-server-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-llama-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-llama-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm:{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-rag/rocm-rag-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-rag-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-rag:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm:on-pr-{{revision}}
+    - GPU=rocm
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-rag/rocm-rag-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-rag-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-rag:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm:{{revision}}
+    - GPU=rocm
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-ubi-llama-server/rocm-ubi-llama-server-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-ubi-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-ubi-llama-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi-llama-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-ubi-llama-server/rocm-ubi-llama-server-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-ubi-llama-server
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-ubi-llama-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi-llama-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:{{revision}}
+    - ENTRYPOINT=/usr/bin/llama-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-ubi-rag/rocm-ubi-rag-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-ubi-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-ubi-rag-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi-rag:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:on-pr-{{revision}}
+    - GPU=rocm
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-ubi-rag/rocm-ubi-rag-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-ubi-rag
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-ubi-rag-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi-rag:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-d160-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.rag
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:{{revision}}
+    - GPU=rocm
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-ubi-whisper-server/rocm-ubi-whisper-server-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-ubi-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-ubi-whisper-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi-whisper-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-ubi-whisper-server/rocm-ubi-whisper-server-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-ubi-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-ubi-whisper-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi-whisper-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-ubi/rocm-ubi-pull-request.yaml

@@ -0,0 +1,41 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-ubi
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-ubi-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-fast/amd64
+  - name: dockerfile
+    value: container-images/rocm-ubi/Containerfile
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-ubi/rocm-ubi-push.yaml

@@ -0,0 +1,38 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-ubi
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-ubi-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-ubi:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-fast/amd64
+  - name: dockerfile
+    value: container-images/rocm-ubi/Containerfile
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-whisper-server/rocm-whisper-server-pull-request.yaml

@@ -0,0 +1,47 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-whisper-server-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-whisper-server:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm:on-pr-{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm:on-pr-{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm-whisper-server/rocm-whisper-server-push.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm-whisper-server
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-whisper-server-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm-whisper-server:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-m2xlarge/amd64
+  - name: dockerfile
+    value: container-images/common/Containerfile.entrypoint
+  - name: parent-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm:{{revision}}
+  - name: build-args
+    value:
+    - PARENT=quay.io/redhat-user-workloads/ramalama-tenant/rocm:{{revision}}
+    - ENTRYPOINT=/usr/bin/whisper-server.sh
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm/rocm-pull-request.yaml

@@ -0,0 +1,41 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "pull_request" && target_branch == "main" && body.action != "ready_for_review"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-on-pull-request
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux-fast/amd64
+  - name: dockerfile
+    value: container-images/rocm/Containerfile
+  pipelineRef:
+    name: pull-request-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/rocm/rocm-push.yaml

@@ -0,0 +1,38 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/containers/ramalama?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: >-
+      event == "push" && target_branch == "main"
+  labels:
+    appstudio.openshift.io/application: ramalama
+    appstudio.openshift.io/component: rocm
+    pipelines.appstudio.openshift.io/type: build
+  name: rocm-on-push
+  namespace: ramalama-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/ramalama-tenant/rocm:{{revision}}
+  - name: build-platforms
+    value:
+    - linux-fast/amd64
+  - name: dockerfile
+    value: container-images/rocm/Containerfile
+  pipelineRef:
+    name: push-pipeline
+  timeouts:
+    pipeline: 6h
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'

.tekton/tasks/test-cmd.yaml

@@ -0,0 +1,36 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: test-cmd
+spec:
+  description: Run a command in a test environment.
+  params:
+  - name: image
+    description: The image to use when setting up the test environment.
+  - name: cmd
+    description: The command to run.
+  - name: envs
+    description: List of environment variables (NAME=VALUE) to be set in the test environment.
+    type: array
+    default: []
+  steps:
+  - name: run
+    image: $(params.image)
+    computeResources:
+      limits:
+        memory: 4Gi
+      requests:
+        cpu: "1"
+        memory: 1Gi
+    securityContext:
+      capabilities:
+        add:
+        - SETFCAP
+    command:
+    - /usr/bin/entrypoint.sh
+    args:
+    - $(params.envs[*])
+    - /bin/bash
+    - -ex
+    - -c
+    - $(params.cmd)

.tekton/tasks/wait-for-image.yaml

@@ -0,0 +1,32 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: wait-for-image
+spec:
+  description: Wait for an image to become available.
+  params:
+  - name: ref
+    description: Location of image to wait for.
+  results:
+  - name: digest
+    description: The digest that the image ref resolves to.
+  steps:
+  - name: check-and-wait
+    image: registry.redhat.io/rhel10/skopeo:latest
+    env:
+    - name: REF
+      value: $(params.ref)
+    - name: RESULTS_DIGEST_PATH
+      value: $(results.digest.path)
+    script: |
+      #!/bin/bash -e
+      echo "Fetching digest of $REF"
+      while true; do
+        DIGEST="$(skopeo inspect -n -f {{.Digest}} "docker://$REF" || :)"
+        if [ "${#DIGEST}" -gt 0 ]; then
+          echo -n "$DIGEST" | tee "$RESULTS_DIGEST_PATH"
+          exit
+        fi
+        echo "$(date -uIseconds): digest unavailable, waiting..."
+        sleep 60
+      done

CONTRIBUTING.md

@@ -56,7 +56,7 @@ This section describes how to make a contribution to RamaLama.
 
 ### Prepare your environment
 
-The minimum version of Python required to use RamaLama is Python 3.8
+The minimum version of Python required to use RamaLama is Python 3.10
 
 ### Fork and clone RamaLama
 
@@ -69,7 +69,8 @@ $ cd ./ramalama/
 
 ### Using the Makefile
 
-RamaLama uses a Makefile for common actions such as compiling RamaLama, building the documentation, and linting.
+RamaLama uses a Makefile for common actions such as compiling RamaLama, building containers,
+building the documentation, linting, executing unit tests or generating coverage reports.
 
 You can list available actions by using:
 ```shell
@@ -80,7 +81,7 @@ Usage: make <target>
 
 ### Install required tools
 
-Makefile allow you to install needed development tools (e.g. the linter):
+The Makefile allows you to install needed development tools (e.g. the linter):
 ```shell
 $ make install-requirements
 ```
@@ -172,7 +173,7 @@ There are several types of tests run by RamaLama's upstream CI.
 
 ### Python Format and lint
 
-All code changes must pass ``make validate``.
+All code changes must pass `make validate`.
 
 ### System Tests
 
@@ -205,7 +206,7 @@ Regardless of the type of PR, all PRs should include:
 * Well-documented code changes, both through comments in the code itself and high-quality commit messages.
 * Additional tests. Ideally, they should fail w/o your code change applied.
   (With a few exceptions, CI hooks will block your PR unless your change
-  includes files named `*_test.go` or under the `test/` subdirectory. Repo
+  includes files under the `test/` subdirectory. Repo
   admins may bypass this restriction by setting the 'No New Tests' GitHub
   label on the PR).
 * Documentation updates to reflect the changes made in the pull request.

MANIFEST.in

@@ -0,0 +1,7 @@
+include README.md LICENSE
+include shortnames/shortnames.conf
+include docs/*.1
+include docs/*.5
+include docs/*.7
+recursive-include completions *
+recursive-include libexec *

Makefile

@@ -8,6 +8,10 @@ PYTHON ?= $(shell command -v python3 python|head -n1)
 DESTDIR ?= /
 PATH := $(PATH):$(HOME)/.local/bin
 IMAGE ?= ramalama
+PROJECT_DIR:=$(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))
+PYTHON_SCRIPTS := $(shell grep -lEr "^\#\!\s*/usr/bin/(env +)?python(3)?(\s|$$)" --exclude-dir={.venv,venv} $(PROJECT_DIR) || true)
+PYTEST_COMMON_CMD ?= PYTHONPATH=. pytest test/unit/ -vv
+BATS_IMAGE ?= localhost/bats:latest
 
 default: help
 
@@ -38,19 +42,17 @@ help:
 	@echo "  - make clean"
 	@echo
 
+install-detailed-cov-requirements:
+	pip install ".[cov-detailed]"
+
+.PHONY: install-cov-requirements
+install-cov-requirements:
+	pip install ".[cov]"
 
 .PHONY: install-requirements
 install-requirements:
-	pip install -U pipx
-	pipx install \
-			argcomplete~=3.0 \
-			black~=25.0 \
-			codespell~=2.0 \
-			flake8~=7.0 \
-			huggingface_hub~=0.28.0 \
-			isort~=6.0 \
-			pytest~=8.3 \
-			wheel~=0.45.0
+	./install-uv.sh
+	pip install ".[dev]"
 
 .PHONY: install-completions
 install-completions: completions
@@ -60,9 +62,9 @@ install-completions: completions
 	install ${SELINUXOPT} -d -m 755 $(DESTDIR)${SHAREDIR}/fish/vendor_completions.d
 	install ${SELINUXOPT} -m 644 completions/fish/vendor_completions.d/ramalama.fish \
 		$(DESTDIR)${SHAREDIR}/fish/vendor_completions.d/ramalama.fish
-	install ${SELINUXOPT} -d -m 755 $(DESTDIR)${SHAREDIR}/zsh/site
-	install ${SELINUXOPT} -m 644 completions/zsh/vendor-completions/_ramalama \
-		$(DESTDIR)${SHAREDIR}/zsh/vendor-completions/_ramalama
+	install ${SELINUXOPT} -d -m 755 $(DESTDIR)${SHAREDIR}/zsh/site-functions
+	install ${SELINUXOPT} -m 644 completions/zsh/site-functions/_ramalama \
+		$(DESTDIR)${SHAREDIR}/zsh/site-functions/_ramalama
 
 .PHONY: install-shortnames
 install-shortnames:
@@ -78,8 +80,8 @@ completions:
 	mkdir -p completions/fish/vendor_completions.d
 	register-python-argcomplete --shell fish ramalama > completions/fish/vendor_completions.d/ramalama.fish
 
-	mkdir -p completions/zsh/vendor-completions
-	-register-python-argcomplete --shell zsh ramalama > completions/zsh/vendor-completions/_ramalama
+	mkdir -p completions/zsh/site-functions
+	-register-python-argcomplete --shell zsh ramalama > completions/zsh/site-functions/_ramalama
 
 .PHONY: install
 install: docs completions
@@ -112,23 +114,23 @@ ifneq (,$(wildcard /usr/bin/python3))
 	/usr/bin/python3 -m compileall -q .
 endif
 
-	! grep -ri "#\!/usr/bin/python3" .
-	flake8 *.py */*.py */*/*.py libexec/* bin/*
+	! grep -ri --exclude-dir ".venv" --exclude-dir "*/.venv" "#\!/usr/bin/python3" .
+	flake8 $(PROJECT_DIR) $(PYTHON_SCRIPTS)
 	shellcheck *.sh */*.sh */*/*.sh
 
 .PHONY: check-format
 check-format:
-	black --check --diff *.py */*.py */*/*.py libexec/* bin/*
-	isort --check --diff *.py */*.py */*/*.py libexec/* bin/*
+	black --check --diff $(PROJECT_DIR) $(PYTHON_SCRIPTS)
+	isort --check --diff $(PROJECT_DIR) $(PYTHON_SCRIPTS)
 
 .PHONY: format
 format:
-	black *.py */*.py */*/*.py libexec/* bin/*
-	isort *.py */*.py */*/*.py libexec/* bin/*
+	black $(PROJECT_DIR) $(PYTHON_SCRIPTS)
+	isort $(PROJECT_DIR) $(PYTHON_SCRIPTS)
 
 .PHONY: codespell
 codespell:
-	codespell --dictionary=-  --ignore-words-list "cann" -w --skip="*/venv*"
+	codespell -w $(PROJECT_DIR) $(PYTHON_SCRIPTS)
 
 .PHONY: test-run
 test-run:
@@ -161,13 +163,50 @@ bats-nocontainer:
 bats-docker:
 	_RAMALAMA_TEST_OPTS=--engine=docker RAMALAMA=$(CURDIR)/bin/ramalama bats -T test/system/
 
+.PHONY: bats-image
+bats-image:
+	podman inspect $(BATS_IMAGE) &> /dev/null || \
+		podman build -t $(BATS_IMAGE) -f container-images/bats/Containerfile .
+
+bats-in-container: extra-opts = --security-opt unmask=/proc/* --device /dev/net/tun --device /dev/fuse
+
+%-in-container: bats-image
+	podman run -it --rm \
+		--userns=keep-id:size=200000 \
+		--security-opt label=disable \
+		--security-opt=mask=/sys/bus/pci/drivers/i915 \
+		$(extra-opts) \
+		-v $(CURDIR):/src \
+		$(BATS_IMAGE) make $*
+
 .PHONY: ci
 ci:
 	test/ci.sh
 
 .PHONY: unit-tests
 unit-tests:
-	PYTHONPATH=. pytest test/unit/
+	$(PYTEST_COMMON_CMD)
+
+.PHONY: unit-tests-verbose
+unit-tests-verbose:
+	$(PYTEST_COMMON_CMD) --full-trace --capture=tee-sys
+
+.PHONY: cov-run
+cov-run: install-cov-requirements
+	PYTHONPATH=. coverage run -m pytest test/unit/
+
+.PHONY: cov-tests
+cov-tests: cov-run
+	PYTHONPATH=. coverage report
+
+.PHONY: detailed-cov-tests
+detailed-cov-tests: install-detailed-cov-requirements cov-run
+	PYTHONPATH=. coverage report -m
+	PYTHONPATH=. coverage html
+	PYTHONPATH=. coverage json
+	PYTHONPATH=. coverage lcov
+	PYTHONPATH=. coverage xml
+
 
 .PHONY: end-to-end-tests
 end-to-end-tests: validate bats bats-nocontainer ci

bin/ramalama

@@ -1,53 +1,12 @@
 #!/usr/bin/env python3
 
-import errno
-import glob
-import os
-import subprocess
 import sys
-import urllib
 
 
-def add_pipx_venvs_bin_to_path():
-    """
-    Adds available pipx virtual environments bin directories to PATH.
-    This function looks for venv in ~/.local/pipx/venvs/ramalama/bin and
-    if it exists appends it to the environment variable PATH.
-    """
-    pipx_bin_path = os.path.expanduser('~/.local/pipx/venvs/ramalama/bin')
-    if os.path.exists(pipx_bin_path):
-        os.environ["PATH"] += ":" + pipx_bin_path
+def main():
+    if not sys.stdout.isatty():
+        sys.stdout.reconfigure(line_buffering=True)
 
-
-def add_site_packages_to_syspath(base_path):
-    """
-    Adds site-packages directories from a given base path to sys.path.
-    """
-    python_version = f'{sys.version_info.major}.{sys.version_info.minor}'
-    search_pattern = os.path.expanduser(f'{base_path}/lib/python{python_version}/site-packages')
-    matched_paths = glob.glob(search_pattern)
-    if matched_paths:
-        for path in matched_paths:
-            sys.path.insert(0, path)
-        return
-
-    # Fallback to a more general pattern if the specific version doesn't match
-    search_pattern = os.path.expanduser(f'{base_path}/lib/python*/site-packages')
-    matched_paths = glob.glob(search_pattern)
-    if matched_paths:
-        for path in matched_paths:
-            sys.path.insert(0, path)
-
-
-def main(args):
-    sharedirs = ["/opt/homebrew/share/ramalama", "/usr/local/share/ramalama", "/usr/share/ramalama"]
-    syspath = next((d for d in sharedirs if os.path.exists(d + "/ramalama/cli.py")), None)
-    if syspath:
-        sys.path.insert(0, syspath)
-
-    add_site_packages_to_syspath('~/.local/pipx/venvs/*')
-    add_site_packages_to_syspath('/usr/local')
-    add_pipx_venvs_bin_to_path()
     sys.path.insert(0, './')
     try:
         import ramalama
@@ -55,54 +14,8 @@ def main(args):
         print(f"ramalama module not found in sys.path: {sys.path}", file=sys.stderr)
         raise
 
-    parser, args = ramalama.init_cli()
-
-    # if autocomplete doesn't exist, just do nothing, don't break
-    try:
-        import argcomplete
-
-        argcomplete.autocomplete(parser)
-    except Exception:
-        None
-
-    def eprint(e, exit_code):
-        ramalama.perror("Error: " + str(e).strip("'\""))
-        sys.exit(exit_code)
-
-    try:
-        from ramalama.migrate import ModelStoreImport
-
-        ModelStoreImport(args.store).import_all()
-    except Exception as ex:
-        print(f"Failed to import models to new store: {ex}")
-
-    # Process CLI
-    try:
-        args.func(args)
-    except urllib.error.HTTPError as e:
-        eprint(f"pulling {e.geturl()} failed: {e} ", errno.EINVAL)
-    except ramalama.HelpException:
-        parser.print_help()
-    except AttributeError as e:
-        parser.print_usage()
-        print("ramalama: requires a subcommand")
-        if args.debug:
-            raise e
-    except IndexError as e:
-        eprint(e, errno.EINVAL)
-    except KeyError as e:
-        eprint(e, 1)
-    except NotImplementedError as e:
-        eprint(e, errno.ENOTSUP)
-    except subprocess.CalledProcessError as e:
-        eprint(e, e.returncode)
-    except KeyboardInterrupt:
-        sys.exit(0)
-    except ValueError as e:
-        eprint(e, errno.EINVAL)
-    except IOError as e:
-        eprint(e, errno.EIO)
+    ramalama.cli.main()
 
 
 if __name__ == "__main__":
-    main(sys.argv[1:])
+    main()

container-images/asahi/Containerfile

@@ -1,6 +1,7 @@
-FROM fedora:42
+FROM quay.io/fedora/fedora:42
 
 ENV ASAHI_VISIBLE_DEVICES 1
-COPY --chmod=755 ../scripts /usr/bin
-RUN build_llama_and_whisper.sh "asahi"
-
+COPY . /src/ramalama
+WORKDIR /src/ramalama
+RUN container-images/scripts/build_llama_and_whisper.sh asahi
+WORKDIR /