add sast-shell-check task

[rhyw]

No description provided.

[rhyw]

Marking as draft for now since we'll need to comply with some sast convention first.

[rhyw]

@kdudka I added 2 commits for review. I'll squash them into one single commit before it's getting merged.

[rhyw]

Commits squashed for brevity.

[kdudka]

The code changes look good. Two remarks though:

• The CI is red because of two ShellCheck issues: https://github.com/konflux-ci/build-definitions/actions/runs/11229456532/job/31227287880?pr=1437 - I think we could use a ShellCheck directive and a small code change to make the CI green again.
• Out of OSH-210, this seems to be the only pull request that does not handle trust to the internal Red Hat CA, which is needed to access the internal KFP git repo. I think we should add the optional trusted-ca volume based on config map and optionally install the CA bundle from there, as done in sast-snyk-check: increased version to 0.3 #1359.

[rhyw]

It's weird the pipeline got stuck, I'm getting:
User rhyw is not allowed to trigger CI via pull_request on this repo.

Can anybody tell how can I re-trigger the CI?

[hanchuntao]

It's weird the pipeline got stuck, I'm getting: User rhyw is not allowed to trigger CI via pull_request on this repo.

Can anybody tell how can I re-trigger the CI?

you can ask the reviewers to approve your request to trigger the CI

[tnevrlka]

/ok-to-test

[rhyw]

Hey can anyone from the konflux team please give a review on this? Thanks!

[rhyw]

Added the sast-shell-check-oci-task in latest commit.

[rhyw]

@brunoapimentel @tkdchen @owtaylor @14rcole @Josh-Everett @jsztuka would you mind give a reivew when got time please?

This has been pending for some time.

[rhyw]

Rebased / added missing OWNERS file for the oci-ta task.