fix(release): copy vendor tarball into kodata instead of symlink

[jkhelil]

Changes

ko v0.19.0 enforces that kodata/ symlinks must not resolve outside the
kodata root (ko-build/ko#1619), a deliberate security hardening. The
run-ko step in tekton/publish.yaml symlinks cmd/*/kodata/source.tar.gz
to a tarball written to an external mktemp -d directory:

TMPDIR=$(mktemp -d)
tar cfz ${TMPDIR}/source.tar.gz vendor/
for d in cmd/*; do
  if [ -d ${d}/kodata/ ]; then
    ln -s ${TMPDIR}/source.tar.gz ${d}/kodata/
  fi
done

Once ko resolves against an image built with ko >= v0.19.0, this
symlink gets rejected:

Error: error processing import paths in "config/100-deployment.yaml":
error resolving image references: tarring kodata: kodata symlink
"cmd/controller/kodata/source.tar.gz" resolves to "/tmp/tmp.XXXXXX/source.tar.gz"
which is outside the kodata root "cmd/controller/kodata"

We hit this exact error in tektoncd/chains' release pipeline after
bumping the pinned ghcr.io/tektoncd/plumbing/ko image digest, which
pulled in ko v0.19.1 (fixed there in
tektoncd/chains#1791).
I checked and tekton/publish.yaml's currently pinned ko image digest
also resolves to ko v0.19.1, so pipeline's release pipeline is exposed
to the same failure the next time it publishes images.

This is the same class of issue already fixed for the kodata/LICENSE
symlinks in #10358 — this PR applies the same style of fix to the
remaining source.tar.gz symlink.

Fix

Copy the tarball into each cmd/*/kodata/ directory instead of
symlinking to it from a shared tmpdir. ko already dereferences symlinks
and embeds the resolved file's bytes into the image layer when tarring
kodata (that's the reason the check exists — to stop arbitrary host file
content from leaking into images), so this has no effect on the final
image size for any cmd/* binary; only the symlink itself was rejected,
not the underlying content. It does mean the vendor tarball is now
written to disk once per cmd/*/kodata/ directory during the build
instead of shared via symlink, which is a small, bounded amount of extra
temporary disk usage during ko resolve (not in the final image).

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps — N/A
• Has Tests included if any functionality added or changed — N/A, release pipeline script fix
• Follows the commit message standard
• Meets the Tekton contributor standards (including functionality, content, code)
• Has a kind label. You can add one by adding a comment on this PR that contains /kind bug
• Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release — not applicable, no user action required

Release Notes

Fix release pipeline `ko resolve` failure caused by `ko` >= v0.19.0 rejecting
the `kodata/source.tar.gz` symlink used to bundle vendored source.

Made with Cursor

[vdemeester]

/kind misc

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[khrm]

/lgtm