4.2 Prefetch dependencies for an offline build

You have removed public inputs from the active build files. Now connect the prepared prefetch-dependencies Task to your pipeline and configure the Dockerfile to consume its output. You edit and apply the pipeline in this module; the prefetch actually runs when you start a PipelineRun in 4.4.

Why this control exists

An offline Maven invocation can only use artifacts already in its local cache. The workshop Task fills .m2-offline from Nexus using dependency:go-offline and an online package pass, which also fills plugin dependencies. The later Dockerfile build runs mvn -o against that cache. A missing artifact makes the offline build fail instead of downloading it from a public repository.

Clone and dependency gate precede prefetch from Nexus; the shared source workspace carries the cache into the BuildConfig and offline Maven

Konflux uses Hermeto for dependency preparation. Here the equivalent workshop control is a Maven Task named prefetch-dependencies, followed by an OpenShift BuildConfig. The workshop does not install Konflux or reproduce its complete build sandbox.

Learning objectives

By the end of this module, you will be able to:

  • Connect the cluster prefetch Task to the pipeline’s source workspace.

  • Make openshift-build wait for successful prefetch.

  • Copy the resulting cache into the image build and run Maven offline.

  • Distinguish an applied Pipeline definition from evidence of a completed run.

Inspect the Task and your pipeline

Continue in /home/lab-user/lightwell-workspace/spring-boot-lw-poc. Read the existing Task’s parameters and workspace declaration. Confirm that the cache directory in lab-pipelines is .m2-offline; use the configured value consistently if it differs.

cd /home/lab-user/lightwell-workspace/spring-boot-lw-poc
git status --short
oc -n lightwell-tasks get task prefetch-dependencies -o yaml
oc -n openshift-operators get configmap lab-pipelines -o yaml
cat .tekton/pipeline.yaml

The seeded openshift-build waits only for lightwell-dep-gate. The new Task must run between them and use the same source workspace. YAML list order alone does not enforce execution order; runAfter supplies that dependency.

Exercise

Add the prefetch Task

Open .tekton/pipeline.yaml. Under spec.tasks, add the following entry after lightwell-dep-gate. Align - name with the existing task entries. The cluster resolver finds the Task in lightwell-tasks; the workspace binding gives it the cloned application files.

- name: prefetch-dependencies
  runAfter: [lightwell-dep-gate]
  taskRef:
    resolver: cluster
    params:
      - name: kind
        value: task
      - name: name
        value: prefetch-dependencies
      - name: namespace
        value: lightwell-tasks
  workspaces:
    - name: source
      workspace: source
  params:
    - name: prefetch-dir
      value: .m2-offline

Change the existing openshift-build task’s runAfter to [prefetch-dependencies]. Preserve its workspace, parameters, and inline build step. This makes prefetch success a prerequisite for the binary BuildConfig input.

Consume the cache in the Dockerfile

Keep the internal FROM references from 4.1. In the build stage, after WORKDIR /build, use the following copy and Maven instructions in place of the existing copy/package instructions. Keep the runtime stage unchanged.

COPY pom.xml ./
COPY src ./src
COPY settings.xml ./
COPY .m2-offline ./.m2-offline
RUN mvn -B -o -s settings.xml -Dmaven.repo.local=.m2-offline -DskipTests package

oc start-build --from-dir sends the source workspace as the build context. COPY then places the cache inside the builder’s /build directory. Ensure .dockerignore, if present, does not exclude .m2-offline. Keep the version override removed: Maven must use the default dependency property you selected in Track 2 and committed in Track 3.

Publish and apply the definition

Before committing, the diff should show one new Task, a changed runAfter, and the Dockerfile’s cache copy and offline command. Do not commit a local Maven cache.

cd /home/lab-user/lightwell-workspace/spring-boot-lw-poc
git diff -- .tekton/pipeline.yaml Dockerfile
git add .tekton/pipeline.yaml Dockerfile
git diff --cached
git commit -m "Prefetch from Nexus before offline image build"
git push origin HEAD
BUILD_NS="$(oc -n gitea get configmap lab-gitea -o jsonpath='{.data.student_build_namespace}')"
oc -n "$BUILD_NS" apply -f .tekton/rbac.yaml
oc -n "$BUILD_NS" apply -f .tekton/pipeline.yaml

The prefetch Task checks the effective Commons Lang dependency tree against 3.14.0.rhlw-00001 before packaging. A mismatch fails the Task even if the earlier source-property gate passed. Inspect active Maven profiles when this comparison fails.

Review

Compare the committed definition with the live Pipeline. Both must resolve prefetch-dependencies from lightwell-tasks, bind source, and make openshift-build wait for it. Confirm that the committed Dockerfile copies the cache and uses -o without a dependency-version override.

git fetch origin
git rev-parse HEAD origin/main
git show origin/main:.tekton/pipeline.yaml
git show origin/main:Dockerfile
oc -n "$BUILD_NS" get pipeline spring-boot-lw-poc-build-sign -o yaml

A successful apply proves that the Pipeline definition is registered. It has not populated a cache or pulled Task images yet. In 4.4, inspect the prefetch logs and offline build result to establish that the configured path actually ran.

Carry the result into module 4.3

Keep the applied pipeline and committed source. Next restrict build-pod egress to the internal services these Tasks need.

A Python equivalent downloads packages into a local directory before an offline install. A Clearinghouse GAV already available in Nexus uses the same Maven prefetch path as other Lightwell dependencies.

Official documentation