[spike] how to feed back thamos advise to cnbi-crd?

[goern]

As an ODH-Admin (using the cnbi feature),
I want to see Thoth's advises on the odh-dashboard
so that I can react on them accordingly.

• create a tekton task to get Thoth Guidance on a PipelineRun
• propose how the result of an advise can be saved with the PipelineRun, they need to be available on the kubernetes custom resource, not as file in a workspace
• propose how we aggregate justifications into CustomNBImage conditions

Acceptance Criteria

• design doc based on thoth station discussion
• comments from ODH UX
• ADR

References

here is an example of a failed task in a tekton pipeline, that has been reconciled into a CustomNBImage objects:

status:
  conditions:
  - lastTransitionTime: "2022-09-26T12:00:26Z"
    message: 'Pipeline default/cnbi-gitrepo can''t be Run; it contains Tasks that
      don''t exist: Couldn''t retrieve Task "git-clone": clustertasks.tekton.dev "git-clone"
      not found'
    reason: CouldntGetTask
    status: "False"
    type: PipelineRunGitrepo
  phase: Failed
  pipelines:
  - name: gitrepo
    pipelineRunName: cnbi-elyra-aidevsecops-tutorial-gitrepo
    ready: "False"

thamos advise output that we could display back to the RHODS/ODH users might be all WARNINGS, for example:

            {
              "link": "https://github.com/ossf/scorecard/blob/main/docs/checks.md",
              "message": "Project does NOT cryptographically sign tags based on Security Scorecards",
              "package_name": "absl-py",
              "type": "WARNING"
            },
           {
              "link": "https://pypi.org/project/argon2-cffi/#history",
              "message": "Package 'argon2-cffi' has no recent release, last release dates back to 2021-12-11 11:47:50.012396",
              "package_name": "argon2-cffi",
              "type": "WARNING"
            },
            {
              "link": "https://github.com/ossf/scorecard/blob/main/docs/checks.md",
              "message": "Project does NOT use static source code analysis based on Security Scorecards",
              "package_name": "argon2-cffi",
              "type": "WARNING"
            },
            {
              "link": "https://github.com/ossf/scorecard/blob/main/docs/checks.md",
              "message": "Project does NOT have a set of contributors from multiple companies based on Security Scorecards",
              "package_name": "asttokens",
              "type": "WARNING"
            },

@Gkrumbach07 could you please fill in the link to the advise clustering and maybe other issues wrt here, thx!

[goern]

/kind feature
/priority important-soon

[codificat]

/wg cnbi

[Gkrumbach07]

related

• [EPIC] Have clustered advise outputs core#417

[codificat]

Also related: #13 about how status is being reported back to the CR and propagated to the UI

[codificat]

Related: #15 (more ADRs)

[codificat]

/assign