Menu
Run Conforma (Enterprise Contract) validation against a Konflux snapshot or a single image to check release policy compliance
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Clone a repo with working hermetic builds and compare the implementation against the hermeto guide to identify gaps and improvements
Provision a VM on Red Hat Beaker for multi-arch testing
Run check-payload locally to scan container images for FIPS compliance issues before they block a Konflux release
Create a temporary pull request PipelineRun from an existing push PipelineRun to test build changes on an RHOAI release branch
Deploy locally-working hermetic build configuration into Konflux pipelines for RHOAI components
Productize an upstream Dockerfile for Konflux builds — base image swaps, digest pinning, FIPS compliance, label metadata, and build-arg simplification
| name | conforma |
| description | Run Conforma (Enterprise Contract) validation against a Konflux snapshot or a single image to check release policy compliance |
| version | 1.0.0 |
Read guides/conforma.md (relative to the plugin root) thoroughly before starting. It is the source of truth for all Conforma validation details — do not duplicate its content, reference it as you go.
Get the image reference: Ask the user for the full image reference (e.g. quay.io/org/image:tag or a @sha256: digest reference).
Ask for the policy: Ask which policy to validate against. Default to registry-rhoai-prod.yaml if they don't have a preference.
Run EC validation: Follow Option A in the guide. Let the user know this may take a minute.
Summarize results: Report the exit code (0 = pass, non-zero = failure). If it failed, summarize the policy violations.
Confirm cluster access: The snapshot path requires kubectl access to the Konflux cluster. Confirm the user is authenticated before proceeding.
Get the application and policy: Ask which Konflux application to validate (e.g. rhoai-v3-4) and which policy to use. Default to registry-rhoai-prod.yaml.
Find and download the snapshot: Follow the guide's snapshot lookup, download, and filtering steps. Show the snapshot name and component count to the user for confirmation. If the user wants to validate only specific components, ask for a filter pattern.
Run EC validation: Follow Option B in the guide. Save the output to ec-report-<application>-<policy-stem>.yaml. This may take several minutes for large snapshots — let the user know.
Summarize results: Report the component count, exit code, and any failures with which components failed and why.
